#VU77449 Input validation error in Microsoft products - CVE-2023-29349

Vulnerability identifier: #VU77449

Vulnerability risk: High

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2023-29349

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
Microsoft ODBC Driver for SQL Server on Windows
Microsoft ODBC Driver for SQL Server on macOS
Microsoft ODBC Driver for SQL Server on Linux
OLE DB Driver
Microsoft SQL Server

Software vendor:
Microsoft

The vulnerability allows a remote attacker to perform a execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can trick the victim to open a specially crafted file and execute arbitrary code on the system.

Install updates from vendor's website.

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-29349