Analysis Summary

CVE-2024-48999 CVSS:8.8

Microsoft SQL Server could allow a remote attacker to execute arbitrary code on the system, caused by an error in the Native Client. By persuading a victim to visit a specially crafted Web site, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVE-2024-49043 CVSS:7.8

Microsoft SQL Server could allow a remote attacker to execute arbitrary code on the system, caused by an untrusted search path error in the Microsoft.SqlServer.XEvent.Configuration.dll file. By persuading a victim to open a specially crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVE-2024-43462 CVSS:8.8

Microsoft SQL Server could allow a remote attacker to execute arbitrary code on the system, caused by an error in the Native Client. By persuading a victim to visit a specially crafted Web site, an attacker could exploit this vulnerability to execute arbitrary code on the system.

CVE-2024-49015 CVSS:8.8

Microsoft SQL Server could allow a remote attacker to execute arbitrary code on the system, caused by an error in the Native Client. By persuading a victim to visit a specially crafted Web site, an attacker could exploit this vulnerability to execute arbitrary code on the system.

Impact

• Code Execution

Indicators of Compromise

CVE

• CVE-2024-48999
• CVE-2024-49043
• CVE-2024-43462
• CVE-2024-49015

Affected Vendors

Remediation

Use Microsoft Automatic Update to apply the appropriate patch for your system, or the Microsoft Security Update Guide to search for available patches.

CVE-2024-48999

CVE-2024-49043

CVE-2024-43462

CVE-2024-49015