CVE-2008-0020

Published: Jul 7, 2009Modified: Apr 23, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

Unspecified vulnerability in the Load method in the IPersistStreamInit interface in the Active Template Library (ATL), as used in the Microsoft Video ActiveX control in msvidctl.dll in DirectShow, in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via unknown vectors that trigger memory corruption, aka "ATL Header Memcopy Vulnerability," a different vulnerability than CVE-2008-0015.

Affected (6)

Products: Microsoft: Windows 2003 Server, Windows Xp

2 products

Windows 2003 Server

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Microsoft Windows 2003 Server	All versions
Microsoft Windows 2003 Server	All versions
Microsoft Windows 2003 Server	All versions
Microsoft Windows Xp	All versions
Microsoft Windows Xp	All versions
Microsoft Windows Xp	All versions

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (16)

http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx

Source: cve@mitre.org

http://secunia.com/advisories/36187

Source: cve@mitre.org

Vendor Advisory

http://www.iss.net/threats/329.html

Source: cve@mitre.org

http://www.securitytracker.com/id?1022712

Source: cve@mitre.org

http://www.us-cert.gov/cas/techalerts/TA09-223A.html

Source: cve@mitre.org

US Government Resource

http://www.vupen.com/english/advisories/2009/2232

Source: cve@mitre.org

PatchVendor Advisory

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-037

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5850

Source: cve@mitre.org

http://blogs.technet.com/srd/archive/2009/08/11/ms09-037-why-we-are-using-cve-s-already-used-in-ms09-035.aspx

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/36187

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.iss.net/threats/329.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1022712

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.us-cert.gov/cas/techalerts/TA09-223A.html

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.vupen.com/english/advisories/2009/2232

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-037

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5850

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.