Vulnerability DatabaseCVE-2024-28934

CVE-2024-28934:
vulnerability analysis and mitigation

Overview

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (CVE-2024-28934) was disclosed on April 9, 2024. The vulnerability affects multiple versions of Microsoft ODBC Driver for SQL Server across Linux, macOS, and Windows platforms, specifically versions from 17.0.1.1 up to (excluding) 17.10.6.1 (NVD).

Technical details

The vulnerability has been classified with a CVSS v3.1 Base Score of 8.8 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The technical nature of the vulnerability has been identified as a Stack-based Buffer Overflow (CWE-121) (NVD).

Impact

Based on the CVSS score and vector, this vulnerability could potentially lead to high impacts on confidentiality, integrity, and availability of the affected systems. The remote code execution capability indicates that successful exploitation could allow attackers to execute arbitrary code on affected systems (NVD).

Exploitability

The vulnerability requires network access and user interaction for successful exploitation, as indicated by the CVSS vector (AV:N/UI:R). No authentication is required (PR:N), and the attack complexity is considered low (AC:L) (NVD).

Mitigation and workarounds

Microsoft has released security updates to address this vulnerability. The fix is included in version 18.3.3.1 of the Microsoft ODBC Driver for SQL Server. Users are advised to update their systems through Windows Update, Microsoft Update Catalog, or by downloading the standalone package (Microsoft Support).