Input validation error in Microsoft products - CVE-2023-36420

Vulnerability identifier: #VU81798

CSH Severity: Medium

CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-36420

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Microsoft ODBC Driver for SQL Server. A remote user can trick a victim to open a specially crafted file and execute arbitrary code on the target system.

Microsoft ODBC Driver for SQL Server on Windows
Microsoft ODBC Driver for SQL Server on macOS
Microsoft ODBC Driver for SQL Server on Linux
Microsoft SQL Server
TeleControl Server Basic

Install updates from vendor's website.

Microsoft ODBC Driver for SQL Server on Windows - addressed in versions 17.10.5.1, 18.6.0007.0
Microsoft ODBC Driver for SQL Server on macOS - addressed in versions 17.10.5.1, 18.3.2.1
Microsoft ODBC Driver for SQL Server on Linux - addressed in versions 17.10.5.1, 18.3.2.1
Microsoft SQL Server - addressed in versions 2019 GDR 15.0.2104.1, 2019 CU22 15.0.4326.1, 2022 GDR 16.0.1105.1, 2022 CU8 16.0.4080.1
TeleControl Server Basic - update to 3.1.2

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-36420

• Multiple vulnerabilities in Microsoft ODBC Driver for SQL Server
• Multiple vulnerabilities in Siemens Telecontrol Server Basic