CVE-2024-43462
Heap-based Buffer Overflow (CWE-122)
Summary
SQL Server Native Client Remote Code Execution Vulnerability. This is a high-severity vulnerability affecting Microsoft SQL Server Native Client. It has a CVSS v3.1 base score of 8.8, indicating a critical level of risk. The vulnerability can be exploited over the network with low attack complexity and requires no privileges, though user interaction is necessary. It is specifically a heap-based buffer overflow vulnerability that enables remote code execution when an authenticated user connects to a malicious SQL server database through OLE DB drivers.
Impact
If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code remotely on the affected system. The impact is severe, with potential for high levels of compromise to confidentiality, integrity, and availability of the system. An attacker could potentially gain full control of the affected SQL Server, access or modify sensitive data, or disrupt normal operations. The combination of low attack complexity, network-based attack vector, and severe potential impact on system confidentiality, integrity, and availability makes this vulnerability particularly concerning for organizations running SQL Server installations.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available. Microsoft has released an official fix for this vulnerability. The patch was added on November 12, 2024.
Mitigation
1. Apply the official patch from Microsoft as soon as possible. 2. Implement network segmentation to limit exposure of SQL Server systems. 3. Ensure that SQL Server Native Client is only used on trusted networks and systems. 4. Educate users about the risks of interacting with untrusted content, as user interaction is required for exploitation. 5. Monitor systems for unusual activity that could indicate exploitation attempts. 6. Keep all SQL Server related software and components up to date with the latest security updates.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Timeline
A CVSS base score of 8.8 has been assigned.
Feedly found the first article mentioning CVE-2024-43462. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-43462
EPSS Score was set to: 0.09% (Percentile: 40.2%)
Detection for the vulnerability has been added to Nessus (211471)
Detection for the vulnerability has been added to Nessus (211472)
EPSS Score was set to: 0.09% (Percentile: 40.3%)