Vulnerability DatabaseCVE-2024-28929

CVE-2024-28929:
vulnerability analysis and mitigation

Overview

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (CVE-2024-28929) was disclosed on April 9, 2024. This vulnerability affects multiple versions of Microsoft ODBC Driver for SQL Server across Linux, macOS, and Windows platforms, including SQL Server 2019, SQL Server 2022, and Visual Studio 2019/2022 (Microsoft Advisory).

Technical details

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a serious security issue. Microsoft has identified this as an Integer Overflow or Wraparound vulnerability (CWE-190) (NVD).

Impact

If successfully exploited, this vulnerability could allow an attacker to execute remote code on affected systems, potentially leading to full system compromise with high impacts on confidentiality, integrity, and availability of the affected system (Microsoft Advisory).

Exploitability

The vulnerability requires network access and user interaction to exploit, as indicated by the CVSS metrics (AV:N/AC:L/PR:N/UI:R). No authentication is required, making it potentially more accessible to attackers (NVD).

Mitigation and workarounds

Microsoft has released security updates to address this vulnerability. The fixes are available through Windows Update, Microsoft Update Catalog, and as standalone packages. The updated version for SQL Server is 18.3.3.1 (Microsoft Support).