Multiple vulnerabilities in Microsoft ODBC Driver for SQL Server
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 4 |
| CVE-ID | CVE-2023-29356 CVE-2023-32027 CVE-2023-32026 CVE-2023-32025 |
| CWE-ID | CWE-20 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
Microsoft ODBC Driver for SQL Server on Windows Universal components / Libraries / Software for developers Microsoft ODBC Driver for SQL Server on Linux Universal components / Libraries / Software for developers Microsoft ODBC Driver for SQL Server on macOS Universal components / Libraries / Software for developers Microsoft SQL Server Server applications / Database software |
| Vendor | Microsoft |
Security Bulletin
This security bulletin contains information about 4 vulnerabilities.
1) Input validation error
EUVDB-ID: #VU77447
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2023-29356
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
Description
The vulnerability allows a remote attacker to perform a execute arbitrary code on the system.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary code on the system.
Install updates from vendor's website.
Vulnerable software versionsMicrosoft ODBC Driver for SQL Server on Windows: 17.0.1.1 2017.170.1.1 - 18.2.1.1 2018.182.1.1
Microsoft ODBC Driver for SQL Server on Linux: 17 - 18.2.2
Microsoft ODBC Driver for SQL Server on macOS: 17 - 18.2.2
Microsoft SQL Server: 2019 CU1 15.0.4003.23 - 2022 RC1 16.0.950.9
CPE2.3- cpe:2.3:a:microsoft:odbc_driver_windows:17.10.3.1:2017.1710.3.1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:odbc_driver_windows:18.2.1.1:2018.182.1.1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:odbc_driver_linux:17.10.4:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:odbc_driver_linux:18.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:odbc_driver_macos:17.10.4:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:odbc_driver_macos:18.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:microsoft_sql_server:2019_GDR:15.0.2101.7:*:*:*:*:*:*
- cpe:2.3:a:microsoft:microsoft_sql_server:2022_RC1:16.0.950.9:*:*:*:*:*:*
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-29356
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Input validation error
EUVDB-ID: #VU77446
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2023-32027
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
Description
The vulnerability allows a remote attacker to perform a execute arbitrary code on the system.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary code on the system.
Install updates from vendor's website.
Vulnerable software versionsMicrosoft ODBC Driver for SQL Server on Windows: 17.0.1.1 2017.170.1.1 - 18.2.1.1 2018.182.1.1
Microsoft ODBC Driver for SQL Server on Linux: 17 - 18.2.2
Microsoft ODBC Driver for SQL Server on macOS: 17 - 18.2.2
Microsoft SQL Server: 2019 CU1 15.0.4003.23 - 2022 RC1 16.0.950.9
CPE2.3- cpe:2.3:a:microsoft:odbc_driver_windows:17.10.3.1:2017.1710.3.1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:odbc_driver_windows:18.2.1.1:2018.182.1.1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:odbc_driver_linux:17.10.4:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:odbc_driver_linux:18.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:odbc_driver_macos:17.10.4:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:odbc_driver_macos:18.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:microsoft_sql_server:2019_GDR:15.0.2101.7:*:*:*:*:*:*
- cpe:2.3:a:microsoft:microsoft_sql_server:2022_RC1:16.0.950.9:*:*:*:*:*:*
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-32027
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Input validation error
EUVDB-ID: #VU77445
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2023-32026
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
Description
The vulnerability allows a remote attacker to perform a execute arbitrary code on the system.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary code on the system.
Install updates from vendor's website.
Vulnerable software versionsMicrosoft ODBC Driver for SQL Server on Windows: 17.0.1.1 2017.170.1.1 - 18.2.1.1 2018.182.1.1
Microsoft ODBC Driver for SQL Server on Linux: 17 - 18.2.2
Microsoft ODBC Driver for SQL Server on macOS: 17 - 18.2.2
Microsoft SQL Server: 2019 CU1 15.0.4003.23 - 2022 RC1 16.0.950.9
CPE2.3- cpe:2.3:a:microsoft:odbc_driver_windows:17.10.3.1:2017.1710.3.1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:odbc_driver_windows:18.2.1.1:2018.182.1.1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:odbc_driver_linux:17.10.4:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:odbc_driver_linux:18.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:odbc_driver_macos:17.10.4:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:odbc_driver_macos:18.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:microsoft_sql_server:2019_GDR:15.0.2101.7:*:*:*:*:*:*
- cpe:2.3:a:microsoft:microsoft_sql_server:2022_RC1:16.0.950.9:*:*:*:*:*:*
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-32026
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Input validation error
EUVDB-ID: #VU77444
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2023-32025
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a execute arbitrary code on the system.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary code on the system.
Install updates from vendor's website.
Vulnerable software versionsMicrosoft ODBC Driver for SQL Server on Windows: 17.0.1.1 2017.170.1.1 - 18.2.1.1 2018.182.1.1
Microsoft ODBC Driver for SQL Server on Linux: 17 - 18.2.2
Microsoft ODBC Driver for SQL Server on macOS: 17 - 18.2.2
Microsoft SQL Server: 2019 CU1 15.0.4003.23 - 2022 RC1 16.0.950.9
CPE2.3- cpe:2.3:a:microsoft:odbc_driver_windows:17.10.3.1:2017.1710.3.1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:odbc_driver_windows:18.2.1.1:2018.182.1.1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:odbc_driver_linux:17.10.4:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:odbc_driver_linux:18.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:odbc_driver_macos:17.10.4:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:odbc_driver_macos:18.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:microsoft_sql_server:2019_GDR:15.0.2101.7:*:*:*:*:*:*
- cpe:2.3:a:microsoft:microsoft_sql_server:2022_RC1:16.0.950.9:*:*:*:*:*:*
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-32025
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
