FeedlyFeedly
CVEsCVEs
Threat IntelligenceThreat Intelligence
Threat IntelligenceThreat Intelligence
Log in
ChangelogChangelog
ChangelogChangelog
Log in
Log in
Start Free Trial
Start Free Trial
FeedlyFeedly
CVEsCVEs
Threat IntelligenceThreat Intelligence
Threat IntelligenceThreat Intelligence
Log in
ChangelogChangelog
ChangelogChangelog
Log in
Log in
Start Free Trial
Start Free Trial

CVE-2024-49014

Double Free (CWE-415)

Published: Nov 12, 2024

010
CVSS 8.8EPSS 0.09%High
CVE info copied to clipboard

Summary

SQL Server Native Client Remote Code Execution Vulnerability. This is a high-severity vulnerability with a CVSS v3.1 base score of 8.8. The vulnerability affects the confidentiality, integrity, and availability of the system, all rated as HIGH impact. It can be exploited over the network with low attack complexity, requires no privileges, but does require user interaction.

Impact

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code remotely on the affected system. The impact is severe, potentially compromising the confidentiality, integrity, and availability of the system. Attackers could potentially gain unauthorized access to sensitive data, modify system configurations, or disrupt normal operations of the SQL Server Native Client.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. Microsoft has released an official fix for this vulnerability on November 12, 2024.

Mitigation

1. Apply the official patch released by Microsoft as soon as possible. 2. Implement network segmentation to limit exposure of vulnerable systems. 3. Employ the principle of least privilege for user accounts. 4. Educate users about the risks of interacting with untrusted content, as user interaction is required for exploitation. 5. Monitor systems for unusual activity that could indicate exploitation attempts. 6. Keep all SQL Server Native Client installations up-to-date with the latest security patches.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Timeline

CVSS

A CVSS base score of 8.8 has been assigned.

Nov 12, 2024 at 5:55 PM / microsoft
First Article

Feedly found the first article mentioning CVE-2024-49014. See article

Nov 12, 2024 at 6:10 PM / Vulners.com RSS Feed
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Nov 12, 2024 at 6:11 PM
CVE Assignment

NVD published the first details for CVE-2024-49014

Nov 12, 2024 at 6:15 PM
EPSS

EPSS Score was set to: 0.09% (Percentile: 40.2%)

Nov 13, 2024 at 4:37 PM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (211471)

Nov 16, 2024 at 12:15 AM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Nessus (211472)

Nov 16, 2024 at 12:15 AM
EPSS

EPSS Score was set to: 0.13% (Percentile: 49.7%)

Nov 18, 2024 at 8:20 PM
Static CVE Timeline Graph

Affected Systems

Microsoft/sql_server_2019
+null more

Patches

Microsoft
+null more

References

SQL Server Native Client Remote Code Execution Vulnerability
Microsoft Security Advisories - MSRC / 1d
An attacker could exploit the vulnerability by tricking an authenticated user (UI:R) into attempting to connect to a malicious SQL server database via a connection driver (for example: OLE DB or OLEDB as applicable). Microsoft SQL Server 2016 for x64-based Systems Service Pack 3 (GDR)

News

SQL Server Native Client Remote Code Execution Vulnerability
Microsoft Security Advisories - MSRC / 1d
An attacker could exploit the vulnerability by tricking an authenticated user (UI:R) into attempting to connect to a malicious SQL server database via a connection driver (for example: OLE DB or OLEDB as applicable). Microsoft SQL Server 2016 for x64-based Systems Service Pack 3 (GDR)
2024-45 - Adobe, Mozilla, Canonical, Red Hat, Microsoft, Google, Jenkins, GitHub, Spring 🗂️
Advisory Week / 1d
Advisory Week Week 45, 2024 National Cyber Awareness System CISA Releases Nineteen Industrial Control Systems Advisories CISA Adds Two Known Exploited Vulnerabilities to Catalog Palo Alto Networks Emphasizes Hardening Guidance Fortinet Releases Security Updates for Multiple Products Microsoft Releases November 2024 Security Updates Adobe Releases Security Updates for Multiple Products Ivanti Releases Security Updates for Multiple Products JCDC’s Collaborative Efforts Enhance Cybersecurity for the 2024 Olympic and Paralympic Games Citrix Releases Security Updates for NetScaler and Citrix Session Recording CISA Releases Five Industrial Control Systems Advisories CISA, FBI, NSA, and International Partners Release Joint Advisory on 2023 Top Routinely Exploited Vulnerabilities CISA Adds Five Known Exploited Vulnerabilities to Catalog Adobe Security Bulletins and Advisories Security updates available for Adobe Photoshop APSB24-89 Security Updates Available for Adobe Commerce APSB24-90 Security Updates Available for Adobe Illustrator APSB24-66 APSB24-87 Security Update Available for Adobe InDesign APSB24-88 Security Updates Available for Adobe Bridge APSB24-77 Security Updates Available for Adobe Audition APSB24-83 Mozilla Security Advisories Security Vulnerabilities fixed in Thunderbird 132.0.1 mfsa2024-62 Security Vulnerabilities fixed in Thunderbird 128.4.3 mfsa2024-61 Ubuntu Security Notices Linux kernel vulnerabilities: USN-7089-6 / USN-7088-5 / USN-7089-5 / USN-7110-1 / USN-7089-4 / USN-7100-2 / USN-7100-1 GD Graphics Library vulnerability: USN-7112-1 Go vulnerabilities: USN-7111-1 / USN-7109-1 Linux kernel vulnerability:
Microsoft’s Security Update in November on High-Risk Vulnerabilities in Multiple Products
NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks. / 4d
On November 13, NSFOCUS CERT detected that Microsoft released a security update patch for November, which fixed 89 security issues, including Windows, Microsoft SQL Server, Microsoft Office, Azure, Open Source Software, Microsoft Visual Studio, System Center and other widely used products, including high-risk vulnerabilities such as privilege escalation vulnerability and remote code execution vulnerability. Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Patch Tuesday November - MSSQL Server
In Progress Plugin Pipeline from Tenable / 5d
Development Last Updated: 11/14/2024 CVEs: CVE-2024-49007 , CVE-2024-49004 , CVE-2024-48994 , CVE-2024-49002 , CVE-2024-49003 , CVE-2024-49001 , CVE-2024-43462 , CVE-2024-49009 , CVE-2024-49008 , CVE-2024-49016 , CVE-2024-49000 , CVE-2024-49015 , CVE-2024-48993 , CVE-2024-38255 , CVE-2024-48996 , CVE-2024-49005 , CVE-2024-48998 , CVE-2024-48999 , CVE-2024-49043 , CVE-2024-49011 , CVE-2024-43459 , CVE-2024-48997 , CVE-2024-49021 , CVE-2024-48995 , CVE-2024-49014 , CVE-2024-49013 , CVE-2024-49018 , CVE-2024-49012 , CVE-2024-49006 , CVE-2024-49017 , CVE-2024-49010
Security Update for Microsoft Exchange Server ( November 2024)
In Progress Plugin Pipeline from Tenable / 5d
Development Last Updated: 11/14/2024 CVEs: CVE-2024-49007 , CVE-2024-49004 , CVE-2024-48994 , CVE-2024-49002 , CVE-2024-49003 , CVE-2024-49001 , CVE-2024-43462 , CVE-2024-49009 , CVE-2024-49008 , CVE-2024-49016 , CVE-2024-49000 , CVE-2024-49015 , CVE-2024-48993 , CVE-2024-38255 , CVE-2024-48996 , CVE-2024-49005 , CVE-2024-48998 , CVE-2024-48999 , CVE-2024-49043 , CVE-2024-49011 , CVE-2024-43459 , CVE-2024-48997 , CVE-2024-49021 , CVE-2024-48995 , CVE-2024-49014 , CVE-2024-49013 , CVE-2024-49018 , CVE-2024-49012 , CVE-2024-49006 , CVE-2024-49017 , CVE-2024-49040 , CVE-2024-49010
See 33 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:Required
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

CVSS 8.8(18246)CWE-415(538)Microsoft(12100)

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI

Feedly Threat Intelligence30-day free trial