QID 379596

Date Published: 2024-04-10

QID 379596: Microsoft SQL Server ODBC and OLE DB Driver for SQL Server Multiple Vulnerabilities for April 2024

Microsoft has released a security update to addressed a Remote Code Execution Vulnerability in OLE DB and ODBC driver for SQL Server. Both of these are APIs for Microsoft SQL server that provide access to a range of data sources.

Affected Software:
Microsoft ODBC Driver 17 for SQL Server on Windows version prior to 17.10.6.1
Microsoft ODBC Driver 18 for SQL Server on Windows version prior to 18.3.3.1
Microsoft ODBC Driver 17 for SQL Server on Linux version prior to 17.10.6.1
Microsoft ODBC Driver 18 for SQL Server on Linux version prior to 18.3.3.1
Microsoft SQL Server 2022 for x64-based Systems (GDR)
Microsoft SQL Server 2019 for x64-based Systems (GDR)
Microsoft SQL Server 2022 for x64-based Systems ( (CU 12))
Microsoft SQL Server 2019 for x64-based Systems (CU 25)
Microsoft OLE DB Driver 19 for SQL Server version prior to 19.3.3.0
Microsoft OLE DB Driver 18 for SQL Server version prior to 18.7.2.0

QID Detection Logic (Authenticated):
On Windows, this QID checks for the vulnerable version of ODBC and OLE DB via the registry keys HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft and HKEY_LOCAL_MACHINE\WOW6432Node\SOFTWARE\Microsoft and the related sub keys for ODBC and OLE DB.
On Linux, this QID checks for the vulnerable version of ODBC based on the installed package.

Successful exploitation may lead to remote code execution and denial of service.

CVSS V3 rated as Critical - 8.8 severity.

CVSS V2 rated as Medium - 4.6 severity.

Solution

Refer to 906 907 908 909 911 912 913 914 915 926 927 929 930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945 043 044 045 046 047 048 982 983 984 985

Vendor References

CVE-2024-28906 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28906
CVE-2024-28908 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28908
CVE-2024-28909 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28909
CVE-2024-28910 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28910
CVE-2024-28911 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28911
CVE-2024-28912 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28912
CVE-2024-28913 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28913
CVE-2024-28914 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28914
CVE-2024-28915 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28915
CVE-2024-28926 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28926
CVE-2024-28927 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28927
CVE-2024-28929 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28929
CVE-2024-28930 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28930
CVE-2024-28931 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28931
CVE-2024-28932 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28932
CVE-2024-28933 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28933
CVE-2024-28934 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28934
CVE-2024-28935 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28935
CVE-2024-28936 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28936
CVE-2024-28937 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28937
CVE-2024-28938 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28938
CVE-2024-28939 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28939
CVE-2024-28940 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28940
CVE-2024-28941 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28941
CVE-2024-28942 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28942
CVE-2024-28943 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28943
CVE-2024-28944 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28944
CVE-2024-28945 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28945
CVE-2024-29043 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-29043
CVE-2024-29044 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-29044
CVE-2024-29045 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-29045
CVE-2024-29046 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-29046
CVE-2024-29047 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-29047
CVE-2024-29048 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-29048
CVE-2024-29982 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-29982
CVE-2024-29983 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-29983
CVE-2024-29984 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-29984
CVE-2024-29985 - msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-29985

CVEs related to QID 379596

CVE-2024-28906 | CVE-2024-28908 | CVE-2024-28909 | CVE-2024-28910 | CVE-2024-28911 | CVE-2024-28912 | CVE-2024-28913 | CVE-2024-28914 | CVE-2024-28915 | CVE-2024-28926 | CVE-2024-28927 | CVE-2024-29982 | CVE-2024-29983 | CVE-2024-29984 | CVE-2024-29985 | CVE-2024-28929 | CVE-2024-28930 | CVE-2024-28931 | CVE-2024-28932 | CVE-2024-28933 | CVE-2024-28934 | CVE-2024-28935 | CVE-2024-28936 | CVE-2024-28937 | CVE-2024-28938 | CVE-2024-28939 | CVE-2024-28940 | CVE-2024-28941 | CVE-2024-28942 | CVE-2024-28943 | CVE-2024-28944 | CVE-2024-28945 | CVE-2024-29043 | CVE-2024-29044 | CVE-2024-29045 | CVE-2024-29046 | CVE-2024-29047 | CVE-2024-29048 |

Software Advisories

Advisory ID	Software	Component	Link
CVE-2024-28906			msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-28906

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].