Microsoft ATL/MFC跟踪工具'dwmapi.dll' DLL装载任意代码执行漏洞

Bugtraq ID: 42811 CVE ID：CVE-2010-3190 Microsoft Visual Studio是微软公司的开发工具套件系列产品，是一个基本完整的开发工具集，包括了软件整个生命周期中所需要的大部分工具。 Microsoft Visual Studio中使用的ATL MFC Trace Tool (AtlTraceTool8.exe)工具不安全装载'dwmapi.dll'库，攻击者可以诱使用户在远程WebDAV或SMB共享上打开 TRC，cu，rs，rc或res文件，可以以用户安全上下文装载任意库。 Microsoft Visual Studio 2010 0 Microsoft Visual Studio 2008 SP1 Microsoft Visual Studio 2008 0 Microsoft Visual Studio 2005 Team Edition for Testers 0 Microsoft Visual Studio 2005 Team Edition for Developers 0 Microsoft Visual Studio 2005 Team Edition for Architects 0 Microsoft Visual Studio 2005 Team Edition 0 Microsoft Visual Studio 2005 Standard Edition 0 Microsoft Visual Studio 2005 Professional Edition 0 Microsoft Visual Studio 2005 Premier Partner Edition - ENU 8.0.50727 .42 Microsoft Visual Studio 2005 64-bit Hosted Visual C++ Tools SP1 Microsoft Visual Studio 2005 SP1 Microsoft Visual Studio 2005 Microsoft Visual Studio .NET 2005 0 Microsoft Visual Studio .NET 2003 Enterprise Architect Microsoft Visual Studio .NET 2003 SP1 Microsoft Visual Studio .NET 2003 0 Microsoft Visual Studio .NET 2003 + Microsoft Visual Basic .NET Standard 2003 + Microsoft Visual C# .NET Standard 2003 + Microsoft Visual C++ .NET Standard 2003 + Microsoft Visual J# .NET Standard 2003 Microsoft Visual C++ 2010 Redistributable Package 0 Microsoft Visual C++ 2008 Redistributable Package SP1 Microsoft Visual C++ 2008 Redistributable Package 0 Microsoft Visual C++ 2005 Redistributable Package SP1 Microsoft Visual C++ 2005 Redistributable Package 0 Microsoft ATL/MFC Trace Tool Build 10.0.30319.1 Avaya Messaging Application Server 5.2 Avaya Messaging Application Server 5 Avaya Messaging Application Server 4 Avaya Meeting Exchange - Webportal 0 Avaya Meeting Exchange - Web Conferencing Server 0 Avaya Meeting Exchange - Streaming Server 0 Avaya Meeting Exchange - Recording Server 0 Avaya Meeting Exchange - Client Registration Server 0 Avaya Meeting Exchange 5.0 .0.52 Avaya Meeting Exchange 5.2 SP2 Avaya Meeting Exchange 5.2 SP1 Avaya Meeting Exchange 5.2 Avaya Meeting Exchange 5.1 SP1 Avaya Meeting Exchange 5.1 Avaya Meeting Exchange 5.0 SP2 Avaya Meeting Exchange 5.0 SP1 Avaya Meeting Exchange 5.0 Avaya Communication Server 1000 Telephony Manager 4.0 Avaya Communication Server 1000 Telephony Manager 3.0 Avaya CallPilot 5.0 Avaya CallPilot 4.0 Avaya Aura Conferencing 6.0 Standard Avaya Aura Conferencing 6.0 SP1 Standard Attachmate Reflection X 2011 Attachmate Reflection Suite for X 2011 Attachmate Reflection for Secure IT Windows Server 7.2 Attachmate Reflection for Secure IT Windows Server 7.0 SP2 Attachmate Reflection for Secure IT Windows Server 7.0 SP1 Attachmate Reflection for Secure IT Windows Server 6.0 Attachmate Reflection for Secure IT UNIX Server 7.2 Attachmate Reflection for Secure IT UNIX Server 7.0 SP1 Attachmate Reflection for Secure IT UNIX Server 6.0 Attachmate Reflection for Secure IT UNIX Client 7.2 Attachmate Reflection for Secure IT UNIX Client 7.0 SP1 Attachmate Reflection for Secure IT UNIX Client 6.0 厂商解决方案 用户可参考如下供应商提供的补丁信息： Microsoft Visual Studio .NET 2003 SP1 Microsoft VS7.1sp1-KB2465373-X86.exe http://www.microsoft.com/downloads/details.aspx?familyid=e9501082-a651 -452b-8c1a-43987ffd3102 Microsoft Visual Studio 2005 SP1 Microsoft VS80sp1-KB2465367-X86-INTL.exe http://www.microsoft.com/downloads/details.aspx?familyid=30db022a-c05e -4d7d-a6eb-ef13ed8cce09