CVE-2014-4061: Medium severity Microsoft SQL Server vulnerability

Published Aug 12, 2014

Updated

Microsoft SQL Server 2008 SP3, 2008 R2 SP2, and 2012 SP1 does not properly control use of stack memory for processing of T-SQL batch commands, which allows remote authenticated users to cause a denial of service (daemon hang) via a crafted T-SQL statement, aka "Microsoft SQL Server Stack Overrun Vulnerability."

Affected Software

8 affected components

Microsoft SQL Server=2008-r2_sp2

Microsoft SQL Server=2008-sp3

Microsoft SQL Server=2012-sp1

Event History

Aug 12, 2014

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-4061?

The severity of CVE-2014-4061 is classified as high due to its potential to cause denial of service.

How do I fix CVE-2014-4061?

To fix CVE-2014-4061, apply the latest security updates provided by Microsoft for the affected SQL Server versions.

Who is affected by CVE-2014-4061?

CVE-2014-4061 affects Microsoft SQL Server versions 2008 SP3, 2008 R2 SP2, and 2012 SP1.

What type of vulnerability is CVE-2014-4061?

CVE-2014-4061 is a stack overrun vulnerability affecting T-SQL batch command processing.

Can CVE-2014-4061 be exploited remotely?

Yes, CVE-2014-4061 can be exploited remotely by authenticated users through crafted T-SQL statements.