Input validation error in Microsoft products - CVE-2023-32025

Vulnerability identifier: #VU77444

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-32025

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary code on the system.

Microsoft ODBC Driver for SQL Server on macOS
Microsoft ODBC Driver for SQL Server on Linux
Microsoft ODBC Driver for SQL Server on Windows
Microsoft SQL Server
TeleControl Server Basic

Install updates from vendor's website.

Microsoft ODBC Driver for SQL Server on macOS - addressed in versions 17.10.4.1, 18.2.1.1
Microsoft ODBC Driver for SQL Server on Linux - addressed in versions 17.10.4.1, 18.2.1.1
Microsoft ODBC Driver for SQL Server on Windows - addressed in versions 17.10.4.1 2017.1710.4.1, 18.2.2.1 2018.182.2.1
Microsoft SQL Server - addressed in versions 2019 CU21 15.0.4316.3, 2022 16.0.4053.3
TeleControl Server Basic - update to 3.1.2

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-32025

• Multiple vulnerabilities in Microsoft ODBC Driver for SQL Server
• Multiple vulnerabilities in Siemens Telecontrol Server Basic