Network Security News

Microsoft patches include fixes for ATL, ActiveX flaws

Wednesday, August 12, 2009

For Microsoft's monthly release of security patches, the company issued nine bulletins Tuesday, six of which are rated critical. The company pointed out patches for critical flaws in the Active Template Library (ATL) and Video ActiveX Control.

Five of the six critical updates have an Exploitability Index rating of 1, which means there is likely to be consistent, reliable code in the wild seeking to exploit the security bugs, Microsoft said.

Security bulletin MS09-037 is an update for Microsoft ATL, which was the source of buggy code that necessitated an out-of-band security patch last month.

Microsoft had patched critical bugs in the ATL component of Visual Studio, which were related to an errant ampersand (&) in the code. Any software developed using the code remained vulnerable to attacks.

Adobe was affected by the ATL flaws in Flash Player and Shockwave Player, which the company had to patch on its own.

Another Microsoft update this month, MS09-043, addresses an Office Web Components vulnerability.

"We strongly encourage customers to review and deploy this bulletin if applicable given that we have seen exploitation in the wild," Microsoft said on its security response center blog.