nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2019-1068 CVE-2019-1068
HIGHRansomware
Microsoft SQL Server Remote Code Execution Vulnerability
Record summary
CVE-2019-1068 has a selected CVSS score of 8.8 (high); EIP currently links 1 repository PoC. VulnCheck reports CVE-2019-1068 use in known ransomware campaigns.
Description
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Sep 4, 2024 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
- Ransomware use
- Observed · VulnCheck
Available material
- Repository PoCs
- 1
Affected products and versions
11| Product | Source | Version range | Status |
|---|---|---|---|
Microsoft SQL ServerBrowse Microsoft / Microsoft SQL Server | CVE List | 2014 Service Pack 2 for 32-bit Systems (CU) | affected |
| 2014 Service Pack 2 for x64-based Systems (CU) | affected | ||
| 2016 for x64-based Systems Service Pack 1 (CU) | affected | ||
| 2017 for x64-based Systems (CU) | affected | ||
| 2016 for x64-based Systems Service Pack 2 (CU) | affected | ||
Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems (GDR)Browse Microsoft / Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems (GDR) | CVE List | Version range not supplied | affected |
Microsoft SQL Server 2014 Service Pack 2 for x64-based Systems (GDR)Browse Microsoft / Microsoft SQL Server 2014 Service Pack 2 for x64-based Systems (GDR) | CVE List | Version range not supplied | affected |
Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU)Browse Microsoft / Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU) | CVE List | Version range not supplied | affected |
Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR)Browse Microsoft / Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR) | CVE List | Version range not supplied | affected |
Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU)Browse Microsoft / Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU) | CVE List | Version range not supplied | affected |
Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)Browse Microsoft / Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR) | CVE List | Version range not supplied | affected |
Microsoft SQL Server 2016 for x64-based Systems Service Pack 1 (GDR)Browse Microsoft / Microsoft SQL Server 2016 for x64-based Systems Service Pack 1 (GDR) | CVE List | Version range not supplied | affected |
Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)Browse Microsoft / Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR) | CVE List | Version range not supplied | affected |
Microsoft SQL Server 2017 for x64-based Systems (GDR)Browse Microsoft / Microsoft SQL Server 2017 for x64-based Systems (GDR) | CVE List | Version range not supplied | affected |
SQL ServerBrowse Microsoft / SQL Server | VulnCheck | Version data not supplied | |
Proofs of concept
1Repository PoCs
GitHubVulnerability-Playground/CVE-2019-1068Repository PoCby Vulnerability-PlaygroundStars: 0Not analyzed2 files
References
2portal.msrc.microsoft.com
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068