Description
The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1 does not properly enforce string termination, which allows remote attackers to obtain sensitive information via a crafted HTML document with an ATL (1) component or (2) control that triggers a buffer over-read, related to ATL headers and buffer allocation, aka "ATL Null String Vulnerability."
References
- 266108 vendor-advisory
- ADV-2009-2034 vdb-entry
- oval:org.mitre.oval:def:7573 vdb-entry signature
- http://www.adobe.com/support/security/bulletins/apsb09-13.html
- http://www.novell.com/support/viewContent.do?externalId=7004997&sliceId=1
- oval:org.mitre.oval:def:6478 vdb-entry signature
- TA09-286A third-party-advisory
- MS09-035 vendor-advisory
- oval:org.mitre.oval:def:6305 vdb-entry signature
- SSRT100013 vendor-advisory
- http://www.adobe.com/support/security/bulletins/apsb09-10.html
- 36374 third-party-advisory
- 36746 third-party-advisory
- 35967 third-party-advisory
- TA09-195A third-party-advisory
- MS09-060 vendor-advisory