The majority of Visual Studio customers who have automatic updating enabled will receive this update automatically and receive the updated ATL. Recommendation. Developers who have built components and controls using ATL should download this update and recompile their components and controls following the guidance provided in the following MSDN article. For more information about the vulnerabilities, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability entry under the next section, Vulnerability Information.

The security update addresses the vulnerabilities by modifying the ATL headers so that components and controls built using the headers can safely initialize from a data stream. NET 2003, Microsoft Visual Studio 2005, Microsoft Visual Studio 2008, Microsoft Visual C++ 2005 Redistributable Package, and Microsoft Visual C++ 2008 Redistributable Package.įor more information on the impact of, and workarounds and mitigations for controls and components that may be vulnerable to these issues, please see Microsoft Security Advisory (973882).įor more information, see the subsection, Affected and Non-Affected Software, in this section. Therefore, this security update is rated Moderate for all supported editions of Microsoft Visual Studio. While most Microsoft Security Bulletins discuss the risk of a vulnerability for a specific product, this security bulletin discusses the vulnerabilities that may be present in products built using the ATL. This security bulletin discusses vulnerabilities that could allow remote code execution if a user loaded a component or control built with the vulnerable versions of ATL. Developers who build and redistribute components and controls using ATL should install the update provided in this bulletin and follow the guidance provided to create, and distribute to their customers, components and controls that are not vulnerable to the vulnerabilities described in this security bulletin.

This security update is specifically intended for developers of components and controls. This security update addresses several privately reported vulnerabilities in the public versions of the Microsoft Active Template Library (ATL) included with Visual Studio. Version: 3.0 General Information Executive Summary Security Bulletin Microsoft Security Bulletin MS09-035 - Moderate Vulnerabilities in Visual Studio Active Template Library Could Allow Remote Code Execution (969706)

Kb2538242 download