Blog Post

SQL Server Blog
2 MIN READ

Update: Security hotfix released for OLE DB driver for SQL Server

DavidEngelMS's avatar
DavidEngelMS
Icon for Microsoft rankMicrosoft
Jul 09, 2024

We've released hotfix packages for the following drivers to address an important security issue:

 

 

The CVE for these OLE DB driver updates is:

 

 

The issue involves connecting to a malicious server that sends malicious data in order to compromise a client. These driver updates are available via Microsoft Update, standalone download, and are included in the SQL Server 2019 and SQL Server 2022 updates that released July 9, 2024.

 

Next steps

For Windows installations, automatic updates will be provided via Microsoft Update or you can download the packages directly:

  • Microsoft OLE DB Driver 18 for SQL Server (version 18.7.4 download)
  • Microsoft OLE DB Driver 19 for SQL Server (version 19.3.5 download)

 

How do I know what version of a driver I have installed?

On Windows, look in Add or remove programs. The version is shown with the installed package. Additionally, you can look at the file properties of the installed files and inspect the Product Version field in the Details. Here are the main files for each driver:

 

    • Microsoft OLE DB Driver for SQL Server - %Windir%\system32\msoledbsql.dll
    • Microsoft OLE DB Driver 19 for SQL Server - %Windir%\system32\msoledbsql19.dll

 

Roadmap

We are committed to improving quality and bringing more feature support for connecting to SQL Server Azure SQL Database Azure Synapse Analytics, and Azure SQL Managed Instance through regular driver releases. We invite you to explore the latest the Microsoft Data Platform has to offer via a trial of Microsoft Azure SQL Database or by evaluating Microsoft SQL Server.

David Engel

Updated Sep 24, 2024
Version 2.0
sqlserverdrivers

18 Comments

Sort By
Show More
  • breynolds110's avatar
    breynolds110
    Copper Contributor
    Aug 22, 2024

    Previous version 18.7.2 is what we reverted to.   We don't believe it was the SQL update KB5040948, still waiting for results as this is passive and not noticeable unless has a higher volume transactional traffic.  Applications are unaware and have not been affected yet, but a bit alarming to see 14 day old connections in hundreds just sitting idle. 

  • breynolds110's avatar
    breynolds110
    Copper Contributor
    Aug 22, 2024

    We are using SQL 2019 enterprise and noticed a few products have hundreds of open IDLE sessions left open after the KB5040711 Update for OLE DB Driver.

     

    We have had to roll this back but appears to be a bug. This has occurred over few products using OLE SQL connection. Normally these connections would be closed but are being left in idle connected state. This has never happened before, and is direct result from the OLE Update.

  • DavidEngelMS's avatar
    DavidEngelMS
    Icon for Microsoft rankMicrosoft
    Jul 26, 2024

    ReinaldoKibelDell 

    By "the article", I assume you mean the linked CVE. That looks to be an error in the FAQ on the CVE (the affected software list on the CVE is correct). The CVE only applies to the MS OLE DB Driver for SQL Server, which only shipped with SQL 2019 and 2022. I'll ask to have the FAQ fixed.

     

    I'm not sure what you are referring to for "the MS update".

     

    For SSMS and any other tool that distributes the OLE DB driver using the MSI installer package, that install will also get automatically updated via a Microsoft Update package.

     

    GertL635 

    It's on the radar but we don't have a timeline for it, at this point.

  • GertL635's avatar
    GertL635
    Copper Contributor
    Jul 23, 2024

    Hello, any plans for distributing an Arm64X build of msoledbsql19.dll, so we can run both x64 and ARM64 applications using this driver on Windows 11 on ARM? The current x64 and Arm64 installers overwrite one another's binaries, so we can only use either architecture to connect?

    Thanks!

  • ReinaldoKibelDell's avatar
    ReinaldoKibelDell
    Brass Contributor
    Jul 17, 2024

    this is a bit confusing, the article shows and the MS update as well, that it applies to SQL 2016 all the way up to 2022. not just 2022 and 2019.

    moreover, what happens to SSMS and ADS and others? these don't use the unsecured OLE-DB?