CVE-2024-43459
Use After Free (CWE-416)
Summary
SQL Server Native Client Remote Code Execution Vulnerability. This is a network-based vulnerability with low attack complexity and no privileges required, but user interaction is necessary. It affects confidentiality, integrity, and availability, all with high impact.
Impact
If exploited, this vulnerability could allow an attacker to execute arbitrary code remotely on the affected system. The impact is severe, with potential for high confidentiality breach, data integrity compromise, and system availability disruption. Given the CVSS base score of 8.8, this is considered a high severity vulnerability. Successful exploitation could lead to complete system compromise, potentially impacting data confidentiality, integrity, and system availability through arbitrary code execution on the client side. Given SQL Server's widespread enterprise adoption, this vulnerability poses a significant risk to business operations.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. Microsoft has released an official fix for this vulnerability as of November 12, 2024.
Mitigation
1. Apply the official patch released by Microsoft as soon as possible. 2. Implement network segmentation to limit exposure of systems running SQL Server Native Client. 3. Enforce the principle of least privilege for user accounts. 4. Educate users about the risks of interacting with untrusted sources, as user interaction is required for exploitation. 5. Monitor for suspicious activities related to SQL Server Native Client usage. 6. Keep all systems and software up-to-date with the latest security patches.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Timeline
A CVSS base score of 8.8 has been assigned.
Feedly found the first article mentioning CVE-2024-43459. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-43459
EPSS Score was set to: 0.09% (Percentile: 40.2%)
Detection for the vulnerability has been added to Nessus (211471)
Detection for the vulnerability has been added to Nessus (211472)
EPSS Score was set to: 0.09% (Percentile: 40.3%)