CVE-2019-1068

Description

A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.

8.8

CVSS

Severity: High

CVSS 3.0 •

CVSS 2.0 •

EPSS 42.69% Top 5%

Vendor Advisory microsoft.com

Affected: Microsoft Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems (GDR)

Affected: Microsoft Microsoft SQL Server

Affected: Microsoft Microsoft SQL Server 2014 Service Pack 2 for x64-based Systems (GDR)

Affected: Microsoft Microsoft SQL Server 2016 for x64-based Systems Service Pack 1 (GDR)

Affected: Microsoft Microsoft SQL Server 2017 for x64-based Systems (GDR)

Affected: Microsoft Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR)

Affected: Microsoft Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR)

Affected: Microsoft Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU)

Affected: Microsoft Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR)

Affected: Microsoft Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU)

References

Link	Tags
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1068	patch vendor advisory

Frequently Asked Questions

What is the severity of CVE-2019-1068?: CVE-2019-1068 has been scored as a high severity vulnerability.
How to fix CVE-2019-1068?: To fix CVE-2019-1068, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2019-1068 being actively exploited in the wild?: It is possible that CVE-2019-1068 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~43% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2019-1068?: CVE-2019-1068 affects Microsoft Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems (GDR), Microsoft Microsoft SQL Server, Microsoft Microsoft SQL Server 2014 Service Pack 2 for x64-based Systems (GDR), Microsoft Microsoft SQL Server 2016 for x64-based Systems Service Pack 1 (GDR), Microsoft Microsoft SQL Server 2017 for x64-based Systems (GDR), Microsoft Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR), Microsoft Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (GDR), Microsoft Microsoft SQL Server 2014 Service Pack 3 for x64-based Systems (CU), Microsoft Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (GDR), Microsoft Microsoft SQL Server 2014 Service Pack 3 for 32-bit Systems (CU).