Vulnerability DatabaseCVE-2024-29045

CVE-2024-29045:
vulnerability analysis and mitigation

Overview

Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVE-2024-29045) was disclosed on April 9, 2024. The vulnerability affects multiple versions of Microsoft OLE DB Driver for SQL Server, including versions 18.0.2 through 18.7.0002.0, 19.0.0 through 19.3.0003.0, and various versions of SQL Server 2019 and 2022 (NVD).

Technical details

The vulnerability has been classified with a CVSS v3.1 base score of 7.5 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is associated with CWE-121 (Stack-based Buffer Overflow) as identified by Microsoft Corporation (NVD).

Impact

This vulnerability could potentially lead to remote code execution if successfully exploited, affecting the confidentiality, integrity, and availability of the system as indicated by the high impact scores across all three categories in the CVSS metrics (NVD).

Exploitability

The vulnerability requires network access (AV:N) with high attack complexity (AC:H), no privileges required (PR:N), and user interaction (UI:R) as indicated by the CVSS vector (NVD).

Mitigation and workarounds

Microsoft has released security updates to address this vulnerability. The fix is available through Windows Update, Microsoft Update Catalog, and as a standalone package that can be downloaded from Microsoft Download Center (Microsoft Support).