David Dewey

**Name of the Vulnerable Software and Affected Versions** Microsoft Visual Studio .NET versions 2003 SP1 through 2008 Microsoft Visual C++ versions 2005 SP1 through 2008 SP1 Windows versions 2000 SP4 through XP SP3, Server 2003 SP2, Vista Gold through SP2, and Server 2008 Gold through SP2 **Description** A remote code execution issue exists due to an error in the Active Template Library (ATL) headers, which could allow an attacker to execute arbitrary code via a malformed stream to an ATL component or control. This is related to the ATL not preventing VariantClear calls on an uninitialized VARIANT. The issue could be exploited by a remote, unauthenticated user by constructing a specially crafted Web page, potentially allowing remote code execution on an affected system. **Recommendations** For Microsoft Visual Studio .NET versions 2003 SP1 through 2008, update to a version that includes the fix for this issue. For Microsoft Visual C++ versions 2005 SP1 through 2008 SP1, update to a version that includes the fix for this issue. For Windows versions 2000 SP4 through XP SP3, Server 2003 SP2, Vista Gold through SP2, and Server 2008 Gold through SP2, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to components and controls built using Visual Studio ATL until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Trend Micro ServerProtect versions 5.7 through 5.58 **Description** The issue allows remote attackers to execute arbitrary code, related to obtaining administrative access to the RPC interface. **Recommendations** For versions 5.7 through 5.58, update to a version that fixes this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Trend Micro ServerProtect versions 5.7 through 5.58 **Description** A heap-based buffer overflow issue exists in an unspecified procedure, potentially related to an RPC interface, allowing remote attackers to execute arbitrary code via unknown vectors. **Recommendations** For versions 5.7 through 5.58, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Trend Micro ServerProtect versions 5.7 through 5.58 **Description** A heap-based buffer overflow issue exists in an unspecified procedure, allowing remote attackers to execute arbitrary code via unknown vectors, possibly related to a read operation over RPC. **Recommendations** For versions 5.7 through 5.58, at the moment, there is no information about a newer version that contains a fix for this issue.

Heap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to the product's configuration, a different vulnerability than CVE-2008-0012 and CVE-2008-0014.

Heap-based buffer overflow in an unspecified procedure in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via unknown vectors, possibly related to the product's configuration, a different vulnerability than CVE-2008-0012 and CVE-2008-0013.