CVE-2024-49008: SQL Server Native Client Remote Code Execution Vulnerability
CVE-2024-49008 is a remote code execution vulnerability in SQL Server Native Client, rated Important by Microsoft, with a CVSS 3.1 base score of 8.8 (High). An attacker can exploit it remotely over the network, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 1.46% probability of exploitation activity in the next 30 days, higher than 74% of all scored vulnerabilities. Microsoft released the fix on 12 November 2024 in the November 2024 Patch Tuesday, delivered through 6 security updates (KB5046857, KB5046859, KB5046855, KB5046856 and more). It affects 6 products in 1 product family (SQL Server).
Key facts
- CVE ID
- CVE-2024-49008
- Severity
- High CVSS 8.8
- Microsoft severity
- Important
- Impact
- Remote Code Execution
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- Weakness
- CWE-122
- EPSS
- 1.46% (percentile 74%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- November 2024 Patch Tuesday
- Product families
- SQL Server
CVSS score and vector
Microsoft scores CVE-2024-49008 at 8.8 (temporal 7.7) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | High |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Frequently asked questions (Microsoft)
How could an attacker exploit this vulnerability?
An attacker could exploit the vulnerability by tricking an authenticated user (UI:R) into attempting to connect to a malicious SQL server database via a connection driver (for example: OLE DB or OLEDB as applicable). This could result in the database returning malicious data that could cause arbitrary code execution on the client.
Affected products (6)
SQL Server
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Microsoft SQL Server 2017 for x64-based Systems (GDR) | KB5046857 | Security Update | 14.0.2070.1 | Maybe |
| Microsoft SQL Server 2019 for x64-based Systems (GDR) | KB5046859 | Security Update | 15.0.2130.3 | Maybe |
| Microsoft SQL Server 2016 for x64-based Systems Service Pack 3 (GDR) | KB5046855 | Security Update | 13.0.6455.2 | Maybe |
| Microsoft SQL Server 2016 for x64-based Systems Service Pack 3 Azure Connect Feature Pack | KB5046856 | Security Update | 13.0.7050.2 | Maybe |
| Microsoft SQL Server 2017 for x64-based Systems (CU 31) | KB5046858 | Security Update | 14.0.3485.1 | Maybe |
| Microsoft SQL Server 2019 for x64-based Systems (CU 29) | KB5046860 | Security Update | 15.0.4410.1 | Maybe |
Security updates (6)
NIST NVD data
- NVD status
- Analyzed
- NVD CVSS
- 8.8 (HIGH)
- NVD weakness
- CWE-122
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| sql server 2016 (x64) | from 13.0.6300.2, before 13.0.6455.2 |
| sql server 2016 (x64) | from 13.0.7000.253, before 13.0.7050.2 |
| sql server 2017 (x64) | from 14.0.1000.169, before 14.0.2070.1 |
| sql server 2017 (x64) | from 14.0.3006.16, before 14.0.3485.1 |
| sql server 2019 (x64) | from 15.0.2000.5, before 15.0.2130.3 |
| sql server 2019 (x64) | from 15.0.4003.23, before 15.0.4410.1 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49008 (Patch, Vendor Advisory)
Acknowledgments
- Anonymous
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |