What is CVE-2023-23375?

CVE-2023-23375 is a high-severity remote code execution vulnerability affecting Microsoft ODBC and OLE DB software for SQL Server. Systems running vulnerable versions of these drivers are at risk, potentially allowing attackers to execute malicious code. The vulnerability impacts Microsoft ODBC Driver 17 and 18, as well as Microsoft OLE DB Driver 18 and 19 for SQL Server. Users are advised to update their software to the latest versions to mitigate this security issue.

Who is impacted by CVE-2023-23375?

The CVE-2023-23375 vulnerability affects users of Microsoft ODBC and OLE DB software, specifically those running SQL Server or applications on their systems. The impacted versions include Microsoft ODBC Driver 17 and 18, as well as Microsoft OLE DB Driver 18 and 19 for SQL Server. This vulnerability could potentially allow attackers to execute malicious code on affected systems.

What to do if CVE-2023-23375 affected you

If you're affected by the CVE-2023-23375 vulnerability, it's important to take action to protect your system. First, update your SQL Server to the relevant version. Next, update your applications to use compatible Microsoft ODBC or OLE DB drivers and update the drivers to the versions listed in the security bulletin. If you're using an application from a software vendor, consult with them to ensure compatibility with the updated drivers and follow their guidance for updating.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-23375 vulnerability, also known as Microsoft ODBC and OLE DB Remote Code Execution Vulnerability, is not listed in CISA's Known Exploited Vulnerabilities Catalog. It was published on April 11, 2023. To mitigate this issue, users should apply the patch provided by Microsoft, update their SQL Server to the relevant version, and update the drivers to the recommended versions.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-20, which refers to improper input validation in Microsoft ODBC and OLE DB software.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the sources listed below.

• Microsoft Security Update Guide