News

Adobe Bugs Linked to Microsoft ATL Flaw

• By Jabulani Leffall
• 07/31/2009

When Adobe Systems Inc. announced that it would periodically have Patch Tuesday releases of its own to coincide with Microsoft's monthly patch rollout, it became clear that Windows plays a vital role in the third-party software firm's security repertoire. That role became even more apparent with the security advisory Adobe released late Thursday.

In the advisory, Adobe said it would patch 12 bugs, three of which, the company implied, caused by vulnerabilities in Windows products. For example, regarding one of the fixes, the advisory said: "The update for Adobe Flash Player resolves the vulnerable version of the Microsoft Active Template Library (ATL) described in Microsoft Security Advisory this past Tuesday."

The bugs could allow hackers to take control of infected systems, resulting in "hijacked systems" or with malware from hackers being implemented on a machine, according to reports.

The vulnerabilities affect the Windows, Mac and Linux operating systems on which users deploy the Flash Player application.

Adobe's announcement comes after Microsoft's out-of-band patch release on Tuesday to fix the ATL vulnerability in Visual Studio and Internet Explorer. The software giant admitted it had known of multiple ATL vulnerabilities since 2008.

Critics in the security community, such as Tyler Reguly of nCircle, contend that although Microsoft has protected against the kill-bit bypass and has patched the public ATL vulnerabilities, "there has been no mention or reference to fixing the issue in msvidctl.dll itself."

Reguly added that while Microsoft has assured users that the ATL patch will help protect them, the company has "not officially stated that a proper patch is available or will be made available."

For instance, though Microsoft issued a patch for Visual Studio to eliminate the bugs in ATL, that update does not fix software developed using the flawed library. Instead, vendors must use the patched Visual Studio to recompile their code, then distribute the new, secure software

Microsoft tried to explain away some of the confusion in a blog post on Monday, as part of its disclosure blitz during the Black Hat security conference. In the post, Microsoft explained that the ATL, which originated in 1997, is parsed out as source code with Visual Studio. ATL, Microsoft explained, "is aimed at simplifying various programming tasks for developers. It provides, among other things, helper functionality that is utilized by most ActiveX components, which is where the vulnerabilities we are disclosing reside."

It appears that this is what may have happened to Adobe's Flash product.

In that vein, Microsoft's blog post suggested that third-party developers and individual users who had "utilized the relevant ATL code in their ActiveX controls" any time during the past 12 years were at risk of being susceptible to bugs, as they may have "inadvertently incorporated these vulnerabilities into their own products."

"It is great to see third parties releasing coverage so quickly," Reguly said. "However, I would imagine that Adobe was one of the vendors that Microsoft shared the patch with early in order to expedite the release. The same will not be true for smaller vendors, and now is a great time to remind people to keep an eye out for updates to those smaller products."