CVE-2024-48999
published 2024-11-12CVE-2024-48999: SQL Server Native Client Remote Code Execution Vulnerability
PriorityP352high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
1.34%
68.5th percentile
SQL Server Native Client Remote Code Execution Vulnerability
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_sql_server_2016_service_pack_3 | >= 13.0.0 < 13.0.6455.2 | 13.0.6455.2 |
| microsoft | microsoft_sql_server_2016_service_pack_3_azure_connect_feature_pack | >= 13.0.0 < 13.0.7050.2 | 13.0.7050.2 |
| microsoft | microsoft_sql_server_2017 | >= 14.0.0 < 14.0.2070.1 | 14.0.2070.1 |
| microsoft | microsoft_sql_server_2017 | >= 14.0.0 < 14.0.3485.1 | 14.0.3485.1 |
| microsoft | microsoft_sql_server_2019 | >= 15.0.0 < 15.0.2130.3 | 15.0.2130.3 |
| microsoft | microsoft_sql_server_2019 | >= 15.0.0 < 15.0.4410.1 | 15.0.4410.1 |
| microsoft | sql_server_2016 | >= 13.0.6300.2 < 13.0.6455.2 | 13.0.6455.2 |
| microsoft | sql_server_2016 | >= 13.0.7000.253 < 13.0.7050.2 | 13.0.7050.2 |
| microsoft | sql_server_2017 | >= 14.0.1000.169 < 14.0.2070.1 | 14.0.2070.1 |
| microsoft | sql_server_2017 | >= 14.0.3006.16 < 14.0.3485.1 | 14.0.3485.1 |
| microsoft | sql_server_2019 | >= 15.0.2000.5 < 15.0.2130.3 | 15.0.2130.3 |
| microsoft | sql_server_2019 | >= 15.0.4003.23 < 15.0.4410.1 | 15.0.4410.1 |
| msrc | microsoft_sql_server_2016_for_x64-based_systems_service_pack_3 | — | — |
| msrc | microsoft_sql_server_2016_for_x64-based_systems_service_pack_3_azure_connect_fea | — | — |
| msrc | microsoft_sql_server_2017_for_x64-based_systems | — | — |
| msrc | microsoft_sql_server_2019_for_x64-based_systems | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vv2x-chjj-4ppm: SQL Server Native Client Remote Code Execution Vulnerability
ghsa_unreviewed·2024-11-12
CVE-2024-48999 [HIGH] CWE-122 GHSA-vv2x-chjj-4ppm: SQL Server Native Client Remote Code Execution Vulnerability
SQL Server Native Client Remote Code Execution Vulnerability
Microsoft
SQL Server Native Client Remote Code Execution Vulnerability
vendor_msrc·2024-11-12·CVSS 8.8
CVE-2024-48999 [HIGH] CWE-122 SQL Server Native Client Remote Code Execution Vulnerability
SQL Server Native Client Remote Code Execution Vulnerability
FAQ: I am running SQL Server on my system. What action do I need to take?
Update your relevant version of SQL Server. Any applicable driver fixes are included in those updates.
I am running my own application on my system. What action do I need to take?
Update your application to use Microsoft OLE DB Driver 18 or 19. Update the drivers to the versions listed on this page, which provide protection against this vulnerability.
I am running an application from a software vendor on my system. What action do I need to take?
Consult with your application vendor if it is compatible with Microsoft OLE DB Driver 18 or 19. Update the drivers to the versions listed in this page, which provide protection against this vulnerability
There are
No detection rules found.
No public exploits indexed.
Bleepingcomputer
Microsoft November 2024 Patch Tuesday fixes 4 zero-days, 89 flaws
blogs_bleepingcomputer·2024-11-12·CVSS 6.5
[MEDIUM] Microsoft November 2024 Patch Tuesday fixes 4 zero-days, 89 flaws
## Microsoft November 2024 Patch Tuesday fixes 4 zero-days, 89 flaws
## Lawrence Abrams
26 Elevation of Privilege vulnerabilities
2 Security Feature Bypass vulnerabilities
52 Remote Code Execution vulnerabilities
1 Information Disclosure vulnerability
4 Denial of Service vulnerabilities
3 Spoofing vulnerabilities
This count does not include two Edge flaws that were previously fixed on November 7th.
To learn more about the non-security updates released today, you can review our dedicated articles on the new Windows 11 KB5046617 and KB5046633 cumulative updates and the Windows 10 KB5046613 update .
## Four zero-days disclosed
This month's Patch Tuesday fixes four zero-days, two of which were actively exploited in attacks, and three were publicly disclosed.
Microsoft classifies a
Tenable
Microsoft’s November 2024 Patch Tuesday Addresses 87 CVEs (CVE-2024-43451, CVE-2024-49039)
blogs_tenable·2024-11-12·CVSS 6.5
[MEDIUM] Microsoft’s November 2024 Patch Tuesday Addresses 87 CVEs (CVE-2024-43451, CVE-2024-49039)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
2024-11-12
Published