CVE-2024-49018
published 2024-11-12CVE-2024-49018: SQL Server Native Client Remote Code Execution Vulnerability
PriorityP353high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
1.52%
71.7th percentile
SQL Server Native Client Remote Code Execution Vulnerability
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_sql_server_2016_service_pack_3 | >= 13.0.0 < 13.0.6455.2 | 13.0.6455.2 |
| microsoft | microsoft_sql_server_2016_service_pack_3_azure_connect_feature_pack | >= 13.0.0 < 13.0.7050.2 | 13.0.7050.2 |
| microsoft | microsoft_sql_server_2017 | >= 14.0.0 < 14.0.2070.1 | 14.0.2070.1 |
| microsoft | microsoft_sql_server_2017 | >= 14.0.0 < 14.0.3485.1 | 14.0.3485.1 |
| microsoft | microsoft_sql_server_2019 | >= 15.0.0 < 15.0.2130.3 | 15.0.2130.3 |
| microsoft | microsoft_sql_server_2019 | >= 15.0.0 < 15.0.4410.1 | 15.0.4410.1 |
| microsoft | sql_server_2016 | >= 13.0.6300.2 < 13.0.6455.2 | 13.0.6455.2 |
| microsoft | sql_server_2016 | >= 13.0.7000.253 < 13.0.7050.2 | 13.0.7050.2 |
| microsoft | sql_server_2017 | >= 14.0.1000.169 < 14.0.2070.1 | 14.0.2070.1 |
| microsoft | sql_server_2017 | >= 14.0.3006.16 < 14.0.3485.1 | 14.0.3485.1 |
| microsoft | sql_server_2019 | >= 15.0.2000.5 < 15.0.2130.3 | 15.0.2130.3 |
| microsoft | sql_server_2019 | >= 15.0.4003.23 < 15.0.4410.1 | 15.0.4410.1 |
| msrc | microsoft_sql_server_2016_for_x64-based_systems_service_pack_3 | — | — |
| msrc | microsoft_sql_server_2016_for_x64-based_systems_service_pack_3_azure_connect_fea | — | — |
| msrc | microsoft_sql_server_2017_for_x64-based_systems | — | — |
| msrc | microsoft_sql_server_2019_for_x64-based_systems | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Attack vector requires a user to connect to a malicious SQL server database via a connection driver (OLE DB / OLEDB); monitor for unexpected outbound SQL Server connections initiated by client applications to untrusted hosts. ↗
- →The attack is client-side RCE triggered by malicious server responses; focus detection on SQL Server Native Client library (sqlncli) loading and abnormal child process spawning from applications making OLE DB connections. ↗
- ·Exploit status is confirmed as not publicly disclosed and not exploited in the wild at time of advisory publication; exploitation is rated 'Less Likely' for the latest software release. ↗
- ·Customer action (patching) is explicitly required; multiple SQL Server builds are affected, each with a distinct patch package referenced via separate KB articles and download family IDs. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
SQL Server Native Client Remote Code Execution Vulnerability
vendor_msrc·2024-11-12·CVSS 8.8
CVE-2024-49018 [HIGH] CWE-197 SQL Server Native Client Remote Code Execution Vulnerability
SQL Server Native Client Remote Code Execution Vulnerability
FAQ: How could an attacker exploit this vulnerability?
An attacker could exploit the vulnerability by tricking an authenticated user (UI:R) into attempting to connect to a malicious SQL server database via a connection driver (for example: OLE DB or OLEDB as applicable). This could result in the database returning malicious data that could cause arbitrary code execution on the client.
SQL Server: SQL Server
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Remote Code Execution
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely
Reference: https://www.microsoft.com/download/details.aspx?familyid=09e83a7b-42e4-4eed-b9a9-47e677391102
Reference: https://support.microso
GHSA
GHSA-pxx2-jxr9-c92g: SQL Server Native Client Remote Code Execution Vulnerability
ghsa_unreviewed·2024-11-12
CVE-2024-49018 [HIGH] CWE-197 GHSA-pxx2-jxr9-c92g: SQL Server Native Client Remote Code Execution Vulnerability
SQL Server Native Client Remote Code Execution Vulnerability
No detection rules found.
No public exploits indexed.
Bleepingcomputer
Microsoft November 2024 Patch Tuesday fixes 4 zero-days, 89 flaws
blogs_bleepingcomputer·2024-11-12·CVSS 6.5
[MEDIUM] Microsoft November 2024 Patch Tuesday fixes 4 zero-days, 89 flaws
## Microsoft November 2024 Patch Tuesday fixes 4 zero-days, 89 flaws
## Lawrence Abrams
26 Elevation of Privilege vulnerabilities
2 Security Feature Bypass vulnerabilities
52 Remote Code Execution vulnerabilities
1 Information Disclosure vulnerability
4 Denial of Service vulnerabilities
3 Spoofing vulnerabilities
This count does not include two Edge flaws that were previously fixed on November 7th.
To learn more about the non-security updates released today, you can review our dedicated articles on the new Windows 11 KB5046617 and KB5046633 cumulative updates and the Windows 10 KB5046613 update .
## Four zero-days disclosed
This month's Patch Tuesday fixes four zero-days, two of which were actively exploited in attacks, and three were publicly disclosed.
Microsoft classifies a
Tenable
Microsoft’s November 2024 Patch Tuesday Addresses 87 CVEs (CVE-2024-43451, CVE-2024-49039)
blogs_tenable·2024-11-12·CVSS 6.5
[MEDIUM] Microsoft’s November 2024 Patch Tuesday Addresses 87 CVEs (CVE-2024-43451, CVE-2024-49039)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
2024-11-12
Published