KLA73223 Multiple vulnerabilities in Microsoft SQL Server

Multiple vulnerabilities were found in Microsoft SQL Server. Malicious users can exploit these vulnerabilities to obtain sensitive information, execute arbitrary code, gain privileges.

Below is a complete list of vulnerabilities:

1. An information disclosure vulnerability in Microsoft SQL Server Native Scoring can be exploited remotely to obtain sensitive information.
2. A remote code execution vulnerability in Microsoft SQL Server Native Scoring can be exploited remotely to execute arbitrary code.
3. An elevation of privilege vulnerability in Microsoft SQL Server can be exploited remotely to gain privileges.
4. An information disclosure vulnerability in Microsoft SQL Server can be exploited remotely to obtain sensitive information.

Original advisories

CVE-2024-37337

CVE-2024-37335

CVE-2024-26191

CVE-2024-37980

CVE-2024-37342

CVE-2024-37965

CVE-2024-37339

CVE-2024-43474

CVE-2024-37966

CVE-2024-37338

CVE-2024-26186

CVE-2024-37340

CVE-2024-37341

Related products

Microsoft-SQL-Server

Microsoft-Azure

CVE list

CVE-2024-37337 high

CVE-2024-37335 critical

CVE-2024-26191 critical

CVE-2024-37980 critical

CVE-2024-37342 high

CVE-2024-37965 critical

CVE-2024-37339 critical

CVE-2024-43474 critical

CVE-2024-37966 high

CVE-2024-37338 critical

CVE-2024-26186 critical

CVE-2024-37340 critical

CVE-2024-37341 critical

KB list

5042211

5042209

5042207

5042214

5042215

5042578

5042749

5042217

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• Microsoft SQL Server 2016 for x64-based Systems Service Pack 3 (GDR)Microsoft SQL Server 2016 for x64-based Systems Service Pack 3 Azure Connect Feature PackMicrosoft SQL Server 2022 for x64-based Systems (GDR)Microsoft SQL Server 2022 for x64-based Systems (CU 14)Microsoft SQL Server 2017 for x64-based Systems (CU 31)Microsoft SQL Server 2019 for x64-based Systems (CU 28)Microsoft SQL Server 2019 for x64-based Systems (GDR)Microsoft SQL Server 2017 for x64-based Systems (GDR)