Security Vulnerabilities in Microsoft Active Template Library (ATL)

Question

My company is concerned on recent Microsoft security vulnerabilities patch. We are accessing all of the tools that we are using whether they are affected by this vulnerability.
We would like to find out on the following product:
Crystal Reports. Net
Crystal Reports Developer XI
Crystal Report 2008
Are they safe from this vulnerability? Please advise me accordingly.
Thank you.
Some information below.
Microsoft Security Advisory 973882 u2013 Vulnerability Vulnerabilities in Microsoft Active Template Library (ATL) Could Allow Remote Code Execution:  http://www.microsoft.com/technet/security/advisory/973882.mspx
Microsoft Security Bulletin MS09-035 u2013 Vulnerabilities in Visual Studio Active Template Library Could Allow Remote Code Execution (969706): http://www.microsoft.com/technet/security/bulletin/MS09-035.mspx
MSDN Article -- Active Template Library Security Update for Developers
http://msdn.microsoft.com/en-us/visualc/ee309358.aspx
Landing Page for ATL Guidance (for consumers, IT Professionals and Developers):
http://www.microsoft.com/atl/

Answer 1

Hi Ludek,
I think, you misunderstand the Microsoft update in question.
The update provides corrections to ATL header files which are used to build the ATL-based controls and components -- it updates Visual Studio installation so, that developers could rebuild their ATL-based components taking advantage of the updated code.
The code from the headers which are subject to the update in question is included in the binaries of the built ATL-based controls and components and not in the shared libraries (like ATL and MFC) that Microsoft ships.
Therefore, only by rebuilding (and re-shipping) the ATL-based controls and components can this update be accounted for.
Here, by ATL-based controls and components I mean Crystal ActiveX viewer and, possibly, RDC runtime -- obviously, it is up to Crystal Reports developers to review, whether the corrected functionality is used within their components.
I am not sure, which version of Visual Studio is used to build ActiveX viewer/RDC. Microsoft issued updates for several versions.
/Alex
P.S. I would also be interested to know, whether there are plans to update CR components, if they are affected by the vulnerability.