CVE:CVE-2009-2493
CNNVD:CNNVD-200907-415
Microsoft Visual Studio是微软公司的开发工具套件系列产品，是一个基本完整的开发工具集，包括了软件整个生命周期中所需要的大部分工具 。
使用Visual Studio的ATL库所编译的组件和控件没有安全地使用OleLoadFromStream，可能允许实例化任意对象，绕过Internet Explorer中Kill Bit等相关安全策略。这个漏洞仅直接影响安装了使用Visual Studio ATL所编译的组件和控件的系统。攻击者可以通过创建特制的网页来利用这个漏洞，当用户查看网页时，该漏洞可能允许远程执行代码 。
solution:Upgrade microsoft visual_c++ to a higher version than 2005:sp1,2008,2008:sp1,and avoid the version 2005:sp1,2008,2008:sp1; Upgrade microsoft windows_2000 to a higher version than *:sp4,and avoid the version *:sp4; Upgrade microsoft windows_2003_server to a higher version than *:sp2,and avoid the version *:sp2; Upgrade microsoft windows_server_2008 to a higher version than *:sp2,-,and avoid the version *:sp2; Upgrade microsoft windows_vista to a higher version than *:sp1,*:sp2,-,and avoid the version *:sp1,*:sp2; Upgrade microsoft windows_xp to a higher version than *:sp2,*:sp3,and avoid the version *:sp2,*:sp3; Upgrade microsoft visual_studio to a higher version than 2003:sp1,2005:sp1,2008,2008:sp1,and avoid the version 2003:sp1,2005:sp1,2008,2008:sp1