CVE-2023-21713: Microsoft SQL Server Remote Code Execution Vulnerability

Overview

Severity
High (CVSS 8.8)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Category
Remote Code Execution
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2023-Feb
Released
2023-02-14
Last Updated
2023-02-16
EPSS Score
2.06% (percentile: 83.9%)

FAQ

There are GDR and/or CU (Cumulative Update) updates offered for my version of SQL Server. How do I know which update to use? First, determine your SQL Server version number. For more information on determining your SQL Server version number, see Microsoft Knowledge Base Article 321185 - How to determine the version, edition, and update level of SQL Server and its components. Second, in the table below, locate your version number or the version range that your version number falls within. The corresponding update is the one you need to install. Note If your SQL Server version number is not represented in the table below, your SQL Server version is no longer supported. Please upgrade to the latest Service Pack or SQL Server product in order to apply this and future security updates. Update number Title Apply if current product version is… This security update also includes servicing releases up through… 5021522 Security update for SQL Server 2022 RTM+GDR (Feb 2023) 16.0.1000.6 N/A 5021124 Security update for SQL Server 2019 CU18+GDR (Feb 2023) 15.0.4003.23 - 15.0.4261.1 KB 5017593 – SQL2019 RTM CU18 5021125 Security update for SQL Server 2019 RTM+GDR (Feb 2023) 15.0.2000.5 - 15.0.2095.3 KB 5014356 - Previous SQL2019 RTM GDR 5021126 Security update for SQL Server 2017 CU31+GDR (Feb 2023) 14.0.3006.16 - 14.0.3456.2 KB 5016884 – SQL2017 RTM CU31 5021127 Security update for SQL Server 2017 RTM+GDR (Feb 2023) 14.0.1000.169 - 14.0.2042.3 KB 5014354 - Previous SQL2017 RTM GDR 5021128 Security update for SQL Server 2016 SP3 Azure Connect Feature Pack+GDR (Feb 2023) 13.0.7000.253 - 13.0.7016.1 KB 5015371 - Previous Azure Connect Feature Pack GDR 5021129 Security update for SQL Server 2016 SP3+GDR (Feb 2023) 13.0.6300.2 - 13.0.6419.1 KB 5014355 - Previous SQL2016 SP3 GDR 5021045 Security update for SQL Server 2014 SP3 CU4+GDR (Feb 2023) 12.0.6205.1 - 12.0.6439.10 KB 5014164 – SQL2014 SP3 CU4 5021037 Security update for SQL Server 2014 SP3+GDR (Feb 2023)

Affected Products (13)

SQL Server

  • Microsoft SQL Server 2016 for x64-based Systems Service Pack 3 Azure Connect Feature Pack
  • Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU 4)
  • Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR)
  • Microsoft SQL Server 2019 for x64-based Systems (GDR)
  • Microsoft SQL Server 2016 for x64-based Systems Service Pack 3 (GDR)
  • Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)
  • Microsoft SQL Server 2017 for x64-based Systems (GDR)
  • Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU 4)
  • Microsoft SQL Server 2019 for x64-based Systems (CU 18)
  • Microsoft SQL Server 2017 for x64-based Systems (CU 31)
  • Microsoft SQL Server 2022 for x64-based Systems (GDR)

ESU

  • Microsoft SQL Server 2012 for 32-bit Systems Service Pack 4 (QFE)
  • Microsoft SQL Server 2012 for x64-based Systems Service Pack 4 (QFE)

Security Updates (9)

Acknowledgments

<a href="https://twitter.com/arudd1ck">Andrew Ruddick</a> with Microsoft Security Response Center

Revision History

  • 2023-02-14: Information published.
  • 2023-02-16: Updated the Security Updates table to include the Extended Support (ESU) products: Microsoft SQL Server 2012 Service Pack 4.