10

CVE-2009-2494

The Active Template Library (ATL) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via vectors related to erroneous free operations after reading a variant from a stream and deleting this variant, aka "ATL Object Type Mismatch Vulnerability."
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ Windows 2000 Version - Update sp4
Microsoft ≫ Windows Server 2008 Edition itanium
Microsoft ≫ Windows Server 2008 Version - Update - Edition x32
Microsoft ≫ Windows Server 2008 Version - Update - Edition x64
Microsoft ≫ Windows Server 2008 Version - Update sp2 Edition itanium
Microsoft ≫ Windows Server 2008 Version - Update sp2 Edition x64
Microsoft ≫ Windows Server 2008 Version - Update sp2 Edition x86
Microsoft ≫ Windows Vista Update sp1
Microsoft ≫ Windows Vista Update sp2
Microsoft ≫ Windows Vista Version - Update sp1
Microsoft ≫ Windows Vista Version - Update sp2
Microsoft ≫ Windows Xp Version - Update sp2
Microsoft ≫ Windows Xp Version - Update sp2 Edition x64
Microsoft ≫ Windows Xp Version - Update sp3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 42.33% 0.985
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CISA-ADP 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx
http://secunia.com/advisories/36187
Vendor Advisory
http://www.us-cert.gov/cas/techalerts/TA09-223A.html
US Government Resource
http://www.vupen.com/english/advisories/2009/2232
Vendor Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-037
http://www.securitytracker.com/id?1022712
http://osvdb.org/56910
http://www.securityfocus.com/bid/35982
Patch
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5708