PT-2009-4387 · Microsoft · Terminal Services Client Activex Control+4

Published 2009-08-12 · Updated 2023-12-07 · CVE-2009-1929

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Microsoft Terminal Services Client ActiveX control versions 5.2 and 6.1

Description: A heap-based buffer overflow issue exists in the Microsoft Terminal Services Client ActiveX control. This allows remote attackers to execute arbitrary code via unspecified parameters to unknown methods. The issue affects Windows XP SP2, Vista SP1 or SP2, or Server 2008 Gold or SP2 with RDP 6.1, and Windows XP SP3 with versions 5.2 or 6.1.

Recommendations: For version 5.2, update to a newer version to mitigate the risk. For version 6.1, update to a newer version to mitigate the risk. As a temporary workaround, consider disabling the ActiveX control until a patch is available.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2009-1929

Affected Products

Terminal Services Client Activex Control

Rdp

Windows Server 2008

Windows Vista

Windows Xp

References · 9

• http://securityfocus.com/bid/35973 · Patch
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-044 · Vendor Advisory
• http://vupen.com/english/advisories/2009/2238 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-1929 · Security Note
• http://secunia.com/advisories/36229 · Vendor Advisory
• http://osvdb.org/56912 · Note
• http://securitytracker.com/id?1022709 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6329 · Note
• http://us-cert.gov/cas/techalerts/TA09-223A.html · Note