CVE-2009-2495
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2009-2495
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold and SP1, and Visual C++ 2005 SP1 and 2008 Gold and SP1 does not properly enforce string termination, which allows remote attackers to obtain sensitive information via a crafted HTML document with an ATL (1) component or (2) control that triggers a buffer over-read, related to ATL headers and buffer allocation, aka "ATL Null String Vulnerability."
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Microsoft Visual Studio ATL空字符串信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Microsoft Visual Studio是微软公司的开发工具套件系列产品，是一个基本完整的开发工具集，包括了软件整个生命周期中所需要的大部分工具 。 Visual Studio所编译的ATL库可能允许读取没有截止空字符的字符串。攻击者可以操控这个字符串越界读取额外的数据，泄露内存中的信息。这个漏洞仅直接影响安装了使用Visual Studio ATL所编译的组件和控件的系统。成功利用这个漏洞的攻击者可以运行恶意的组件或控件，导致泄漏信息、向第三方转发用户数据，或在受影响的系统上访问登录用户可访问的任
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
II. Public POCs for CVE-2009-2495
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2009-2495
请登录查看更多情报信息。
- http://www.adobe.com/support/security/bulletins/apsb09-13.htmlx_refsource_CONFIRM
- http://www.novell.com/support/viewContent.do?externalId=7004997&sliceId=1x_refsource_CONFIRM
- http://www.adobe.com/support/security/bulletins/apsb09-10.htmlx_refsource_CONFIRM
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-266108-1vendor-advisoryx_refsource_SUNALERT
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-035vendor-advisoryx_refsource_MS
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-060vendor-advisoryx_refsource_MS
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6305vdb-entrysignaturex_refsource_OVAL
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7573vdb-entrysignaturex_refsource_OVAL
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6478vdb-entrysignaturex_refsource_OVAL
- https://nvd.nist.gov/vuln/detail/CVE-2009-2495
Same Patch Batch · n/a · 2009-07-29 · 14 CVEs total
| CVE-2009-0696 | ISC BIND 9 函数dns_db_findrdataset() 拒绝服务漏洞 | |
| CVE-2009-0901 | Microsoft Visual Studio ATL VariantClear()远程代码执行漏洞 | |
| CVE-2009-1164 | Cisco Wireless LAN Controller安全漏洞 | |
| CVE-2009-1165 | Cisco Wireless LAN Controller拒绝服务漏洞 | |
| CVE-2009-1166 | Cisco无线LAN控制器Cisco Wireless LAN Controller平台拒绝服务漏洞 | |
| CVE-2009-1167 | Cisco无线LAN控制器非授权修改配置漏洞 | |
| CVE-2009-1426 | HP ProLiant Onboard Administrator Powered by LO100i 远程拒绝服务漏洞 | |
| CVE-2009-1917 | Microsoft Internet Explorer和Windows 资源管理错误漏洞 | |
| CVE-2009-1918 | Microsoft Internet Explorer和Windows 代码注入漏洞 | |
| CVE-2009-1919 | Microsoft Internet Explorer和Windows 代码注入漏洞 | |
| CVE-2009-2493 | Microsoft Visual Studio ATL库COM对象初始化代码执行漏洞 | |
| CVE-2009-2620 | Firebird SQL op_connect_request请求远程拒绝服务漏洞 | |
| CVE-2009-2644 | Sun Solaris Auditing竞争条件本地拒绝服务漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2009-2495
No comments yet