KLA50361
Multiple vulnerabilities in Microsoft SQL Server

Обновлено: 29/09/2023
Дата обнаружения
15/06/2023
Уровень угрозы
High
Описание

Multiple vulnerabilities were found in Microsoft SQL Server. Malicious users can exploit these vulnerabilities to execute arbitrary code.

Below is a complete list of vulnerabilities:

  1. A remote code execution vulnerability in Microsoft ODBC Driver for SQL Server can be exploited remotely to execute arbitrary code.
  2. A remote code execution vulnerability in Microsoft OLE DB can be exploited remotely to execute arbitrary code.
  3. A remote code execution vulnerability in Microsoft ODBC and OLE DB can be exploited remotely to execute arbitrary code.
Пораженные продукты

Microsoft ODBC Driver 18 for SQL Server on Linux
Microsoft OLE DB Driver 19 for SQL Server
Microsoft ODBC Driver 17 for SQL Server on MacOS
Microsoft ODBC Driver 18 for SQL Server on MacOS
Microsoft ODBC Driver 18 for SQL Server on Windows
Microsoft SQL Server 2019 for x64-based Systems (CU 21)
Microsoft OLE DB Driver 18 for SQL Server
Microsoft ODBC Driver 17 for SQL Server on Windows
Microsoft SQL Server 2022 for x64-based Systems (CU 5)
Microsoft ODBC Driver 17 for SQL Server on Linux

Решение

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Первичный источник обнаружения
CVE-2023-32027
CVE-2023-32025
CVE-2023-29356
CVE-2023-32028
CVE-2023-32026
CVE-2023-29349
Оказываемое влияние
?
ACE 
[?]
Связанные продукты
Microsoft SQL Server
Microsoft Windows
CVE-IDS
CVE-2023-320275.0Warning
CVE-2023-320255.0Warning
CVE-2023-293565.0Warning
CVE-2023-320285.0Warning
CVE-2023-320265.0Warning
CVE-2023-293495.0Warning
KB list

5026806
5025808