Vulnerability DatabaseCVE-2024-28945

CVE-2024-28945:
vulnerability analysis and mitigation

Overview

Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVE-2024-28945) was disclosed on April 9, 2024. The vulnerability affects multiple versions of Microsoft OLE DB Driver for SQL Server, including versions 18.0.2 through 18.7.0002.0, 19.0.0 through 19.3.0003.0, SQL Server 2019, and SQL Server 2022 (NVD).

Technical details

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The weakness has been classified as CWE-191 (Integer Underflow) by Microsoft Corporation (NVD).

Impact

This vulnerability could allow an attacker to execute remote code on affected systems, potentially leading to full system compromise with high impacts on confidentiality, integrity, and availability of the affected system (NVD).

Exploitability

The vulnerability requires network access and user interaction to exploit, as indicated by the CVSS vector (AV:N/UI:R). No public exploits or active exploitation in the wild have been reported at this time (NVD).

Mitigation and workarounds

Microsoft has released security updates to address this vulnerability. The fix is available through Windows Update, Microsoft Update Catalog, and as a standalone package that can be downloaded from Microsoft Download Center (Microsoft Support).