Vulnerability DatabaseCVE-2024-28939

CVE-2024-28939:
vulnerability analysis and mitigation

Overview

Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVE-2024-28939) was disclosed on April 9, 2024. The vulnerability affects multiple versions of Microsoft OLE DB Driver for SQL Server, including versions 18.0.2 through 18.7.0002.0, 19.0.0 through 19.3.0003.0, and various SQL Server 2019 and 2022 installations (NVD).

Technical details

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. It is associated with CWE-209 (Generation of Error Message Containing Sensitive Information) as identified by Microsoft Corporation (NVD).

Impact

This vulnerability could potentially lead to remote code execution with high impacts on confidentiality, integrity, and availability of the affected systems. The CVSS score of 8.8 indicates severe potential consequences if successfully exploited (NVD).

Exploitability

The vulnerability requires network access and user interaction for successful exploitation, as indicated by the CVSS vector string. No privilege escalation is required for the attack (NVD).

Mitigation and workarounds

Microsoft has released security updates to address this vulnerability. The fixes are available through Windows Update, Microsoft Update Catalog, and as standalone packages. Users are advised to update to version 19.3.0003.0 or later for Microsoft OLE DB Driver 19 (Microsoft Support).