Input validation error in OLE DB Driver and Microsoft SQL Server - CVE-2023-36417
Published: October 10, 2023
Vulnerability identifier: #VU81824
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-36417
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the system.
The vulnerability exists due to insufficient validation of user-supplied input in Microsoft SQL ODBC Driver. A remote attacker can trick a victim to connect to a malicious SQL server and execute arbitrary code on the target system.
Affected software
OLE DB Driver
Microsoft SQL Server
TeleControl Server Basic
Microsoft SQL Server
TeleControl Server Basic
How to mitigate CVE-2023-36417
Install updates from vendor's website.
OLE DB Driver - update to 19.3.0002.0
Microsoft SQL Server - addressed in versions 2019 GDR 15.0.2104.1, 2019 CU22 15.0.4326.1, 2022 GDR 16.0.1105.1, 2022 CU8 16.0.4080.1
TeleControl Server Basic - update to 3.1.2
Microsoft SQL Server - addressed in versions 2019 GDR 15.0.2104.1, 2019 CU22 15.0.4326.1, 2022 GDR 16.0.1105.1, 2022 CU8 16.0.4080.1
TeleControl Server Basic - update to 3.1.2