Input validation error in Microsoft products - CVE-2023-36730

Vulnerability identifier: #VU81801

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-36730

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Microsoft ODBC Driver for SQL Server. A remote attacker can trick a victim to connect to a malicious SQL server via ODBC and execute arbitrary code on the target system.

Microsoft ODBC Driver for SQL Server on Linux
Microsoft ODBC Driver for SQL Server on macOS
Microsoft ODBC Driver for SQL Server on Windows
Microsoft SQL Server
TeleControl Server Basic

Install updates from vendor's website.

Microsoft ODBC Driver for SQL Server on Linux - addressed in versions 17.10.5.1, 18.3.2.1
Microsoft ODBC Driver for SQL Server on macOS - addressed in versions 17.10.5.1, 18.3.2.1
Microsoft ODBC Driver for SQL Server on Windows - addressed in versions 17.10.5.1, 18.6.0007.0
Microsoft SQL Server - addressed in versions 2019 GDR 15.0.2104.1, 2019 CU22 15.0.4326.1, 2022 GDR 16.0.1105.1, 2022 CU8 16.0.4080.1
TeleControl Server Basic - update to 3.1.2

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-36730

• Multiple vulnerabilities in Microsoft ODBC Driver for SQL Server
• Multiple vulnerabilities in Siemens Telecontrol Server Basic