Vulnerability DatabaseCVE-2024-29985

CVE-2024-29985:
vulnerability analysis and mitigation

Overview

Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (CVE-2024-29985) was disclosed on April 9, 2024. This vulnerability affects multiple versions of Microsoft OLE DB Driver for SQL Server, including versions 18.0.2 through 18.7.0002.0, versions 19.0.0 through 19.3.0003.0, and SQL Server 2019 versions 15.0.2000.5 through 15.0.2110.4 (NVD).

Technical details

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Microsoft has classified this as a heap-based buffer overflow vulnerability under CWE-122 (NVD).

Impact

If successfully exploited, this vulnerability could allow an attacker to achieve remote code execution with high impacts on confidentiality, integrity, and availability of the affected system (Microsoft Advisory).

Exploitability

The vulnerability requires network access and user interaction to exploit, as indicated by the CVSS vector string (AV:N/UI:R). The attack complexity is considered low, and no privileges are required to execute the attack (NVD).

Mitigation and workarounds

Microsoft has released security updates to address this vulnerability. The fixes are available through Windows Update, Microsoft Update Catalog, and as standalone MSI packages. The latest secure version for OLE DB Driver 19 is 19.3.0003.0 (Microsoft Support).