United States : Verizon offers free service to help developers test for Microsoft ATL flaw.

Byline: Mamta03

Verizon Business is offering a free scanning service for developers to help them determine whether any controls or components they built using Microsoft's ATL are vulnerable to flaws Microsoft patched on Tuesday.

Verizon Business is offering a free scanning service to help software developers more quickly determine whether any controls and components they built using Microsoft's Active Template Libraries (ATL) are vulnerable to the issues identified in the emergency security update issued by Microsoft on Tuesday.

The scanning service, along with a self-diagnostic questionnaire, is available online. It is designed to scan compiled code and produce a list of properties where the ATL vulnerabilities might exist, said Russ Cooper, senior security strategist with Verizon Business.

Microsoft's ATL is used by software developers to create items such as Active X controls for Windows systems. Microsoft yesterday issued an emergency security bulletin for several remote code execution vulnerabilities in the public versions of the ATL included with Visual Studio. The update was timed to beat a scheduled presentation today at the Black Hat Security Conference, where researchers are planning to release more details about the flaws. At least one attack using an ATL vulnerability has been seen in the wild, according to Microsoft.

Verizon's code-testing service gives developers who have used ATL in their controls a way to determine which part of their code they need to be checking first so they can prioritize any remediation efforts, Cooper said. It is a "really complex situation" trying to find out whether controls and components developed using ATL can be exploited, he said. The conditions under which vulnerable code might be exploited "aren't obvious on the surface," he said. "We can look for snippets of code inside the finished code that help us identify if the control has the potential to be exploited."

Though the scan can help developers identify potential issues much faster than a manual scan would, Verizon's code tester does not eliminate the need for a manual code review, Cooper said. Nor does it offer any guarantee against false positives or false negatives.

Copyright : Euclid Infotech Pvt. Ltd.

Provided by Syndigate.info an Albawaba.com company