PT-2009-4900 · Microsoft · Active Template Library+5

Ryan Smith · Published 2009-07-29 · Updated 2026-05-27 · CVE-2009-2493

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Visual Studio .NET versions 2003 SP1 through 2008 SP1 Microsoft Visual C++ versions 2005 SP1 through 2008 SP1 Windows versions prior to Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2

Description A remote code execution issue exists due to the improper restriction of OleLoadFromStream in instantiating objects from data streams. This allows remote attackers to execute arbitrary code via a crafted HTML document with an ATL component or control. The vulnerability is related to ATL headers and bypassing security policies. An attacker could exploit this by constructing a specially crafted Web page, potentially gaining the same user rights as the logged on user.

Recommendations For Microsoft Visual Studio .NET versions 2003 SP1 through 2008 SP1, update to a version that is not affected by this issue. For Microsoft Visual C++ versions 2005 SP1 through 2008 SP1, update to a version that is not affected by this issue. For Windows versions prior to Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2, update to a version that is not affected by this issue. As a temporary workaround, consider restricting access to ActiveX controls built with vulnerable Microsoft Active Template Library (ATL) headers until a patch is available.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

CWE-264

Related Identifiers

CVE-2009-2493

Affected Products

Active Template Library

Internet Explorer

Visual C++

Visual Studio .Net

Outlook

Windows

References · 42

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-055 · Vendor Advisory
• http://adobe.com/support/security/advisories/apsa09-04.html · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2493 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-037 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1020775.1-1 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-266108-1 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-060 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-035 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2493 · Security Note
• http://sunsolve.sun.com/search/document.do?assetkey=1-66-264648-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00002.html · Vendor Advisory
• http://marc.info/?l=bugtraq&m=126592505426855&w=2 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-072 · Vendor Advisory
• http://adobe.com/support/security/bulletins/apsb09-11.html · Patch
• https://docs.microsoft.com/security-updates/securitybulletins/2009/ms09-035 · Note