The vulnerability of the OLE DB driver for SQL Server, related to buffer overflows in the stack, allows a hacker to execute arbitrary code.

🗓️ 07 Aug 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

The object linking embedding database driver for server has a stack overflow vulnerability that allows remote arbitrary code execution.

Reporter	Title	Published	Views	Family All 22
CNNVD	Microsoft SQL Server Security Vulnerability	9 Jul 202400:00	–	cnnvd
CVE	CVE-2024-28928	9 Jul 202417:02	–	cve
Cvelist	CVE-2024-28928 SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability	9 Jul 202417:02	–	cvelist
EUVD	EUVD-2024-25994	3 Oct 202520:07	–	euvd
Microsoft KB	KB5040936 - Description of the security update for SQL Server 2022 GDR: July 9, 2024	9 Jul 202407:00	–	mskb
Microsoft KB	KB5040939 - Description of the security update for SQL Server 2022 CU13: July 9, 2024	9 Jul 202407:00	–	mskb
Microsoft KB	KB5040940 - Description of the security update for SQL Server 2017 CU31: July 9, 2024	9 Jul 202407:00	–	mskb
Microsoft KB	KB5040942 - Description of the security update for SQL Server 2017 GDR: July 9, 2024	9 Jul 202407:00	–	mskb
Microsoft KB	KB5040944 - Description of the security update for SQL Server 2016 SP3 Azure Connect Feature Pack: July 9, 2024	9 Jul 202407:00	–	mskb
Microsoft KB	KB5040946 - Description of the security update for SQL Server 2016 SP3 GDR: July 9, 2024	9 Jul 202407:00	–	mskb

Source	Link
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28928
vuldb	www.vuldb.com/
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
web	www.web.nvd.nist.gov/view/vuln/detail

07 Aug 2024 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 38.8

CVSS 210

EPSS0.02257

database interface stack overflow remote execution arbitrary code