KLA12562 RCE vulnerability in Microsoft SQL Server

A remote code execution vulnerability was found in Microsoft SQL Server. Malicious users can exploit this vulnerability to execute arbitrary code.

Original advisories

CVE-2022-29143

Related products

Microsoft-SQL-Server

Microsoft-Azure

CVE list

CVE-2022-29143 unknown

KB list

5014354

5014353

5015371

5014553

5014355

5014351

5014165

5014164

5014365

5014356

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

Affected Products

• Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR)Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU 4)Microsoft SQL Server 2017 for x64-based Systems (GDR)Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU 4)Microsoft SQL Server 2019 for x64-based Systems (GDR)Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)Microsoft SQL Server 2019 for x64-based Systems (CU 16)Microsoft SQL Server 2017 for x64-based Systems (CU 29)Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (CU 17)Microsoft SQL Server 2016 for x64-based Systems Service Pack 3 (GDR)Microsoft SQL Server 2016 for x64-based Systems Service Pack 3 Azure Connectivity PackMicrosoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)