What is CVE-2024-0056?

CVE-2024-0056 is a high-severity security feature bypass vulnerability affecting Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Providers. This vulnerability allows attackers to exploit SQL Server on various versions of the Microsoft .NET Framework running on Windows operating systems, including Windows Server (2008, 2012, 2016, 2019, 2022) and Windows 10 and 11. Organizations need to address this vulnerability to protect their data and applications.

Who is impacted by this?

The CVE-2024-0056 vulnerability affects users of Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Providers on various versions of Microsoft .NET Framework, .NET 6, .NET 7, and .NET 8. Impacted versions include Microsoft.Data.SqlClient 2.1 to 2.1.7, 3.1 to 3.1.5, 4.0 to 4.0.5, and 5.1 to 5.1.3; System.Data.SqlClient up to 4.8.6; Microsoft SQL Server 2022 (all versions); Microsoft Visual Studio 2022 (17.2 to 17.2.23, 17.4 to 17.4.15, 17.6 to 17.6.11, and 17.8 to 17.8.4); Microsoft .NET Framework 4.8 up to 4.8.04690.02, 3.5, 4.6.2, 4.7, 4.7.1, and 4.7.2; and Microsoft .NET 6.0.0 to 6.0.26, 7.0.0 to 7.0.15, and 8.0.0.

What to do if CVE-2024-0056 affected you

If you're affected by the CVE-2024-0056 vulnerability, it's important to take action to protect your systems. Follow these steps:

1. Update the relevant version of SQL Server.

2. Update your application to use Microsoft ODBC Driver 17 (or 18) for SQL Server or Microsoft OLE DB Driver 18 (or 19).

3. Install the January 2024 update(s) for .NET Framework if using System.Data.SqlClient on .NET Framework.

4. Update the NuGet package reference to an updated version if using System.Data.SqlClient on .NET 6, .NET 7, or .NET 8.

5. Update the NuGet package reference as listed in the affected packages if using Microsoft.Data.SqlClient.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2024-0056 vulnerability, a security feature bypass in Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Providers, is not listed in CISA's Known Exploited Vulnerabilities Catalog. This vulnerability has a maximum severity of "Important" and could allow an attacker to bypass security features. To protect against this vulnerability, users should update their software.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-319, which involves cleartext transmission of sensitive information in Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Providers.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the sources listed below.

• Microsoft Security Update Guide