PT-2009-4387 · Microsoft · Terminal Services Client Activex Control+4

CVE-2009-1929 · Publicado 2009-08-12 · Atualizado 2023-12-07

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft Terminal Services Client ActiveX control versions 5.2 and 6.1

Description: A heap-based buffer overflow issue exists in the Microsoft Terminal Services Client ActiveX control. This allows remote attackers to execute arbitrary code via unspecified parameters to unknown methods. The issue affects Windows XP SP2, Vista SP1 or SP2, or Server 2008 Gold or SP2 with RDP 6.1, and Windows XP SP3 with versions 5.2 or 6.1.

Recommendations: For version 5.2, update to a newer version to mitigate the risk. For version 6.1, update to a newer version to mitigate the risk. As a temporary workaround, consider disabling the ActiveX control until a patch is available.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2009-1929

Produtos afetados

Terminal Services Client Activex Control

Rdp

Windows Server 2008

Windows Vista

Windows Xp

Referências · 9

• http://osvdb.org/56912 · Nota
• http://securityfocus.com/bid/35973 · Correção
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-044 · Aviso do Fabricante
• http://vupen.com/english/advisories/2009/2238 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-1929 · Nota de Segurança
• http://secunia.com/advisories/36229 · Aviso do Fabricante
• http://securitytracker.com/id?1022709 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6329 · Nota
• http://us-cert.gov/cas/techalerts/TA09-223A.html · Nota