#VU79153 Input validation error in Microsoft products - CVE-2023-38169
Published: August 8, 2023 / Updated: August 10, 2023
Vulnerability identifier: #VU79153
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: CVE-2023-38169
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Microsoft SQL Server
OLE DB Driver
Microsoft ODBC Driver for SQL Server on Linux
Microsoft ODBC Driver for SQL Server on macOS
Microsoft ODBC Driver for SQL Server on Windows
Microsoft SQL Server
OLE DB Driver
Microsoft ODBC Driver for SQL Server on Linux
Microsoft ODBC Driver for SQL Server on macOS
Microsoft ODBC Driver for SQL Server on Windows
Software vendor:
Microsoft
Microsoft
Description
The vulnerability allows a remote attacker to execute arbitrary code on the system.
The vulnerability exists due to insufficient validation of user-supplied input in Microsoft OLE DB. A remote attacker can trick a victim into attempting to connect to a malicious SQL server via OLEDB and execute arbitrary code on the target system.
Remediation
Install updates from vendor's website.