Microsoft SQL Server DenialofService Vulnerability (CVE202336728)
CVE-2023-36728 Published on October 10, 2023

Microsoft SQL Server Denial of Service Vulnerability
Microsoft SQL Server Denial of Service Vulnerability

Vendor Advisory NVD

Weakness Type

Out-of-bounds Read

The software reads data past the end, or before the beginning, of the intended buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash. A crash can occur when the code reads a variable amount of data and assumes that a sentinel exists to stop the read operation, such as a NUL in a string. The expected sentinel might not be located in the out-of-bounds memory, causing excessive data to be read, leading to a segmentation fault or a buffer overflow. The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent read operation then produces undefined or unexpected results.

Products Associated with CVE-2023-36728

Want to know whenever a new CVE is published for Microsoft products? stack.watch will email you.

Microsoft SQL Server

Microsoft Odbc Driver For Sql Server

Microsoft Ole Db Driver For Sql Server

Affected Versions

Microsoft SQL Server 2019 (CU 22):

Version 15.0.0 and below 15.0.4326.1 is affected.

Microsoft SQL Server 2022 (CU 8):

Version 15.0.0 and below 16.0.4080.1 is affected.

Microsoft SQL Server 2017 (GDR):

Version 14.0.0 and below 14.0.2052.1 is affected.

Microsoft SQL Server 2014 Service Pack 3 (GDR):

Version 12.0.0 and below 12.0.6179.1 is affected.

Microsoft SQL Server 2014 Service Pack 3 (CU 4):

Version 12.0.0 and below 12.0.6449.1 is affected.

Microsoft SQL Server 2019 (GDR):

Version 15.0.0 and below 15.0.2104.1 is affected.

Microsoft SQL Server 2016 Service Pack 3 (GDR):

Version 13.0.0 and below 13.0.6435.1 is affected.

Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack:

Version 13.0.0 and below 13.0.7029.3 is affected.

Microsoft SQL Server 2017 (CU 31):

Version 14.0.0 and below 14.0.3465.1 is affected.

Microsoft SQL Server 2022 (GDR):

Version 16.0.0 and below 16.0.1105.1 is affected.

Microsoft OLE DB Driver 19 for SQL Server:

Version 19.0.0 and below 19.3.0002.0 is affected.

Microsoft OLE DB Driver 18 for SQL Server:

Version 18.0.0 and below 18.6.0007.0 is affected.

Microsoft ODBC Driver 17 for SQL Server on Windows:

Version 17.0.0.0 and below 17.10.5.1 is affected.

Microsoft ODBC Driver 17 for SQL Server on Linux:

Version 17.0.0.0 and below 17.10.5.1 is affected.

Microsoft ODBC Driver 17 for SQL Server on MacOS:

Version 17.0.0.0 and below 17.10.5.1 is affected.

Microsoft ODBC Driver 18 for SQL Server on Windows:

Version 18.0.0.0 and below 18.3.2.1 is affected.

Microsoft ODBC Driver 18 for SQL Server on Linux:

Version 18.0.0.0 and below 18.3.2.1 is affected.

Microsoft ODBC Driver 18 for SQL Server on MacOS:

Version 18.0.0.0 and below 18.3.2.1 is affected.

Exploit Probability

EPSS

0.08%

Percentile

23.59%