Input validation error in Microsoft products - CVE-2023-29349

Vulnerability identifier: #VU77449

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-29349

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary code on the system.

Microsoft ODBC Driver for SQL Server on macOS
Microsoft ODBC Driver for SQL Server on Linux
Microsoft ODBC Driver for SQL Server on Windows
OLE DB Driver
Microsoft SQL Server
TeleControl Server Basic

Install updates from vendor's website.

Microsoft ODBC Driver for SQL Server on macOS - addressed in versions 17.10.4.1, 18.2.1.1
Microsoft ODBC Driver for SQL Server on Linux - addressed in versions 17.10.4.1, 18.2.1.1
Microsoft ODBC Driver for SQL Server on Windows - addressed in versions 17.10.4.1 2017.1710.4.1, 18.2.2.1 2018.182.2.1
OLE DB Driver - addressed in versions 18.6.6 18.6.0006.0, 19.3.1 19.3.0001.0
Microsoft SQL Server - addressed in versions 2019 CU21 15.0.4316.3, 2022 16.0.4053.3
TeleControl Server Basic - update to 3.1.2

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-29349

• Remote code execution in Microsoft ODBC and OLE DB drivers
• Multiple vulnerabilities in Siemens Telecontrol Server Basic