The vulnerability of the OLE DB driver for SQL Server lies in the use of memory after it is freed, allowing an attacker to execute arbitrary code.

🗓️ 08 Aug 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

OleDb driver for SQL Server memory after free enables remote code execution.

Reporter	Title	Published	Views	Family All 22
CNNVD	Microsoft SQL Server Security Vulnerability	9 Jul 202400:00	–	cnnvd
CVE	CVE-2024-21308	9 Jul 202417:02	–	cve
Cvelist	CVE-2024-21308 SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability	9 Jul 202417:02	–	cvelist
EUVD	EUVD-2024-19021	3 Oct 202520:07	–	euvd
Microsoft KB	KB5040936 - Description of the security update for SQL Server 2022 GDR: July 9, 2024	9 Jul 202407:00	–	mskb
Microsoft KB	KB5040939 - Description of the security update for SQL Server 2022 CU13: July 9, 2024	9 Jul 202407:00	–	mskb
Microsoft KB	KB5040940 - Description of the security update for SQL Server 2017 CU31: July 9, 2024	9 Jul 202407:00	–	mskb
Microsoft KB	KB5040942 - Description of the security update for SQL Server 2017 GDR: July 9, 2024	9 Jul 202407:00	–	mskb
Microsoft KB	KB5040944 - Description of the security update for SQL Server 2016 SP3 Azure Connect Feature Pack: July 9, 2024	9 Jul 202407:00	–	mskb
Microsoft KB	KB5040946 - Description of the security update for SQL Server 2016 SP3 GDR: July 9, 2024	9 Jul 202407:00	–	mskb

Source	Link
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21308
cve	www.cve.mitre.org/cgi-bin/cvename.cgi
opencve	www.opencve.io/cve/CVE-2024-21308
vuldb	www.vuldb.com/
web	www.web.nvd.nist.gov/view/vuln/detail

08 Aug 2024 00:00Current

6.1Medium risk

Vulners AI Score6.1

CVSS 38.8

CVSS 210

EPSS0.01611

memory after free remote code execution database driver vulnerability