Adobe Bugs Linked to Microsoft ATL Flaw

When Adobe Systems Inc. announced that it would periodically have Patch Tuesday releases of its own to coincide with Microsoft's monthly patch rollout, it became clear that Windows plays a vital role in the third-party software firm's security repertoire. That role became even more apparent with the security advisory Adobe released late Thursday.

In the advisory, Adobe said it would patch 12 bugs, three of which, the company implied, caused by vulnerabilities in Windows products. For example, regarding one of the fixes, the advisory said: "The update for Adobe Flash Player resolves the vulnerable version of the Microsoft Active Template Library (ATL) described in Microsoft Security Advisory this past Tuesday."

The bugs could allow hackers to take control of infected systems, resulting in "hijacked systems" or with malware from hackers being implemented on a machine, according to reports.

The vulnerabilities affect the Windows, Mac and Linux operating systems on which users deploy the Flash Player application.

Adobe's announcement comes after Microsoft's out-of-band patch release on Tuesday to fix the ATL vulnerability in Visual Studio and Internet Explorer. The software giant admitted it had known of multiple ATL vulnerabilities since 2008.

Critics in the security community, such as Tyler Reguly of nCircle, contend that although Microsoft has protected against the kill-bit bypass and has patched the public ATL vulnerabilities, "there has been no mention or reference to fixing the issue in msvidctl.dll itself."

Reguly added that while Microsoft has assured users that the ATL patch will help protect them, the company has "not officially stated that a proper patch is available or will be made available."

For instance, though Microsoft issued a patch for Visual Studio to eliminate the bugs in ATL, that update does not fix software developed using the flawed library. Instead, vendors must use the patched Visual Studio to recompile their code, then distribute the new, secure software

Microsoft tried to explain away some of the confusion in a blog post on Monday, as part of its disclosure blitz during the Black Hat security conference. In the post, Microsoft explained that the ATL, which originated in 1997, is parsed out as source code with Visual Studio. ATL, Microsoft explained, "is aimed at simplifying various programming tasks for developers. It provides, among other things, helper functionality that is utilized by most ActiveX components, which is where the vulnerabilities we are disclosing reside."

It appears that this is what may have happened to Adobe's Flash product.

In that vein, Microsoft's blog post suggested that third-party developers and individual users who had "utilized the relevant ATL code in their ActiveX controls" any time during the past 12 years were at risk of being susceptible to bugs, as they may have "inadvertently incorporated these vulnerabilities into their own products."

"It is great to see third parties releasing coverage so quickly," Reguly said. "However, I would imagine that Adobe was one of the vendors that Microsoft shared the patch with early in order to expedite the release. The same will not be true for smaller vendors, and now is a great time to remind people to keep an eye out for updates to those smaller products."

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.


  • How To Configure Windows 10 for Intel Optane Memory

    Intel's Optane memory technology can significantly improve the performance of your Windows 10 system -- provided you enable it correctly. A single mistake can render the system unbootable. Here's how to do it the right way.

  • Microsoft and SAP Enhance Partnership with Teams Integration

    Microsoft and SAP this week described continuing partnership efforts on Microsoft Azure, while also planning a Microsoft Teams integration with SAP's enterprise resource planning product and other solutions.

  • Blue Squares Graphic

    Microsoft Previews Azure IoT Edge for Linux on Windows

    Microsoft announced a preview of Azure IoT Edge for Linux on Windows, which lets organizations tap Linux virtual machine processes that also work with Windows- and Azure-based processes and services.

  • How To Automate Tasks in Azure SQL Database

    Knowing how to automate tasks in the cloud will make you a more productive DBA. Here are the key concepts to understand about cloud scripting and a rundown of the best tools for automating code in Azure.

comments powered by Disqus