Attachmate Reflection for Secure IT Active Template Library Remote Code Execution Vulnerabilities
BID:36652
Info
Attachmate Reflection for Secure IT Active Template Library Remote Code Execution Vulnerabilities
| Bugtraq ID: | 36652 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 08 2009 12:00AM |
| Updated: | Oct 09 2009 04:09PM |
| Credit: | Vendor |
| Vulnerable: |
Attachmate Reflection for Secure IT Windows Server 7.0 SP1 Attachmate Reflection for Secure IT Windows Client 7.0 SP1 |
| Not Vulnerable: |
Attachmate Reflection for Secure IT Windows Server 7.0 SP2 Attachmate Reflection for Secure IT Windows Client 7.0 SP2 |
Discussion
Attachmate Reflection for Secure IT Active Template Library Remote Code Execution Vulnerabilities
Reflection for Secure IT is prone to remote code-execution vulnerabilities because it was compiled against the Microsoft Active Template Library (ATL).
Remote attackers can exploit these issues to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will likely result in a denial-of-service condition.
These issues are caused by the vulnerabilities described in Microsoft security bulletin MS09-035 and advisory 973882 and are related to the following BIDs:
35828 Microsoft Visual Studio Active Template Library COM Object Remote Code Execution Vulnerability
35830 Microsoft Visual Studio Active Template Library NULL String Information Disclosure Vulnerability
35832 Microsoft Visual Studio ATL 'VariantClear()' Remote Code Execution Vulnerability
Reflection for Secure IT is prone to remote code-execution vulnerabilities because it was compiled against the Microsoft Active Template Library (ATL).
Remote attackers can exploit these issues to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will likely result in a denial-of-service condition.
These issues are caused by the vulnerabilities described in Microsoft security bulletin MS09-035 and advisory 973882 and are related to the following BIDs:
35828 Microsoft Visual Studio Active Template Library COM Object Remote Code Execution Vulnerability
35830 Microsoft Visual Studio Active Template Library NULL String Information Disclosure Vulnerability
35832 Microsoft Visual Studio ATL 'VariantClear()' Remote Code Execution Vulnerability
Exploit / POC
Attachmate Reflection for Secure IT Active Template Library Remote Code Execution Vulnerabilities
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Attachmate Reflection for Secure IT Active Template Library Remote Code Execution Vulnerabilities
Solution:
Vendor updates are available. Please see the referenced advisory for details.
Solution:
Vendor updates are available. Please see the referenced advisory for details.
References
Attachmate Reflection for Secure IT Active Template Library Remote Code Execution Vulnerabilities
References:
References:
- Reflection for Secure IT Homepage (Attachmate)
- Reflection for Secure IT Windows Client 7.1 Service Pack 2 (SP2) Release Notes (Attachmate)
- Reflection for Secure IT Windows Server 7.1 Service Pack 2 (SP2) Release Notes (Attachmate)
- Microsoft Security Advisory (973882): Vulnerabilities in Microsoft Active Templa (Microsoft)
- Microsoft Security Bulletin MS09-035 (Microsoft)