Input validation error in Microsoft products - CVE-2023-38169

Vulnerability identifier: #VU79153

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-38169

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Microsoft OLE DB. A remote attacker can trick a victim into attempting to connect to a malicious SQL server via OLEDB and execute arbitrary code on the target system.

Microsoft ODBC Driver for SQL Server on Linux
Microsoft ODBC Driver for SQL Server on macOS
Microsoft ODBC Driver for SQL Server on Windows
OLE DB Driver
Microsoft SQL Server
TeleControl Server Basic

Install updates from vendor's website.

Microsoft ODBC Driver for SQL Server on Linux - addressed in versions 18.2.2, 18.3.1
Microsoft ODBC Driver for SQL Server on macOS - addressed in versions 18.2.2, 18.3.1
Microsoft ODBC Driver for SQL Server on Windows - addressed in versions 18.2.2.1 2018.182.2.1, 18.3.1.1
OLE DB Driver - addressed in versions 18.6.6 18.6.0006.0, 19.3.1 19.3.0001.0
Microsoft SQL Server - addressed in versions 2019 CU21 15.0.4316.3, 2022 CU5 16.0.4045.3
TeleControl Server Basic - update to 3.1.2

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-38169

• Remote code execution in Microsoft OLE DB
• Multiple vulnerabilities in Siemens Telecontrol Server Basic