A vulnerability has been discovered in Microsoft Visual C++ Redistributable, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due certain MFC libraries loading other libraries in an insecure manner (e.g. mfc90u.dll when loading dwmapi.dll). This can be exploited to load arbitrary libraries by tricking a user into opening a file located on a remote WebDAV or SMB share in an application linking against the vulnerable MFC libraries.

Successful exploitation allows execution of arbitrary code.

Solution
Apply patches.
Further details available to Secunia VIM customers

Provided and/or discovered by
Reported by various people in a number of applications bundling vulnerable versions of Microsoft Visual C++ Redistributable.

Changelog
Further details available to Secunia VIM customers

Original Advisory
MS11-025 (KB2455033, KB2465361, KB2465367, KB2465373, KB2467173, KB2467174, KB2467175, KB2500212, KB2565063):
http://www.microsoft.com/technet/security/Bulletin/MS11-025.mspx

Other references
Further details available to Secunia VIM customers

Alternate/detailed remediation
Further details available in Customer Area

Deep Links
Links available to Secunia VIM customers