Blog Post

SQL Server Blog
3 MIN READ

Update: Hotfixes released for ODBC and OLE DB drivers for SQL Server

DavidEngelMS's avatar
DavidEngelMS
Icon for Microsoft rankMicrosoft
Oct 11, 2023

We've released hotfix packages for the following drivers to address important security issues:

 

 

Related CVEs for these updates are the following:

 

 

All the issues involve a malicious server sending malicious data in order to compromise a client. These driver updates are included in the SQL Server 2019 and SQL Server 2022 updates that released October 10, 2023. If you use the drivers in the context of one of those SQL Server installs, those SQL Server updates will update the drivers for you. If you have deployed the drivers as part of a standalone application, you may want to consider updating them. The vulnerabilities require a potential attacker to direct a connection to a malicious server, so if your scenario allows that, you should update.

 

Next steps

For Windows installations, you can directly download the packages:

  • Microsoft ODBC Driver 17.10.5 for SQL Server (download)
  • Microsoft ODBC Driver 18.3.2 for SQL Server (download)
  • Microsoft OLE DB Driver 18.6.7 for SQL Server (download)
  • Microsoft OLE DB Driver 19.3.2 for SQL Server (download)

Linux and macOS packages for ODBC are also available and can be updated via package managers on most platforms. For installation details and manual instructions, see the online instructions for Linux or macOS.

 

How do I know what version of a driver I have installed?

On Windows, look in Add or remove programs. The version is shown with the installed package. Additionally, you can look at the file properties of the installed files and inspect the Product Version field in the Details. Here are the main files for each driver:

 

    • Microsoft ODBC Driver 17 for SQL Server - %Windir%\system32\msodbcsql17.dll
    • Microsoft ODBC Driver 18 for SQL Server - %Windir%\system32\msodbcsql18.dll
    • Microsoft OLE DB Driver 18 for SQL Server - %Windir%\system32\msoledbsql.dll
    • Microsoft OLE DB Driver 19 for SQL Server - %Windir%\system32\msodlebsql19.dll

On Linux you can use package manager commands to view the version of the installed package. Or you can look directly at the files, which live in /opt/microsoft/msodbcsql17/lib64/ or /opt/microsoft/msodbcsql18/lib64/ and have the version in their name: libmsodbcsql-17.X.so.X.X or libmsodbcsql-18.X.so.X.X.

 

Roadmap

We are committed to improving quality and bringing more feature support for connecting to SQL Server Azure SQL Database Azure SQL DW, and Azure SQL Managed Instance through regular driver releases. We invite you to explore the latest the Microsoft Data Platform has to offer via a trial of Microsoft Azure SQL Database or by evaluating Microsoft SQL Server.

David Engel

Published Oct 11, 2023
Version 1.0
SQLServerDrivers
  • DavidEngelMS's avatar
    DavidEngelMS
    Icon for Microsoft rankMicrosoft
    Oct 20, 2023

    Ma9p KB5029187 applies to SQL Server 2016, which never shipped with ODBC 17, ODBC 18, OLE DB 18, or OLE DB 19. These updates only apply to ODBC 17, ODBC 18, OLE DB 18, and OLE DB 19. The updates to ODBC 17 and OLE DB 18 were included in corresponding SQL Server 2019 & 2022 updates on Oct 10.

  • StephanGee's avatar
    StephanGee
    Steel Contributor
    Oct 20, 2023

    Are older versions also affected or are they "EOL" and no longer monitored for security issues?

  • Ma9p's avatar
    Ma9p
    Copper Contributor
    Oct 20, 2023

    Are these hot fix packages included in KB5029187?

  • John_Osti's avatar
    John_Osti
    Copper Contributor
    Oct 24, 2023

    Does anyone know the command to upgrade if you see the message "A lower version of this product has been detected, would you like to upgrade", deploying the updates via SCCM.

  • sujirou's avatar
    sujirou
    Copper Contributor
    Dec 05, 2023

    big thanks for this post! my server runs on Windows Server 2019 Standard x64 and is installed with an OLE DB Driver for SQL Server version 18.6.6.0. recently, our security systems flagged an alert a known vulnerability - CVE-2023-36417. looking at this post, i noticed it has several updated versions available. while common sense dictates i should install the latest version, 19.3.2, i'm curious to know the specific version required for my server. could you provide guidance on the recommended version for my setup? 

  • DavidEngelMS's avatar
    DavidEngelMS
    Icon for Microsoft rankMicrosoft
    Feb 14, 2024

    sujirou Microsoft OLE DB Driver 18 for SQL Server and Microsoft OLE DB Driver 19 for SQL Server can both be installed at the same time and are both currently supported. Applications can reference either one. Both major versions were serviced as part of this release. Since SQL Server 2019 shipped with Microsoft OLE DB Driver 18 for SQL Server and references that one, you'll want to make sure you have the latest version of that driver (v18) installed for SQL Server 2019 to use.

     

    Regards,

    David

  • EvilDr's avatar
    EvilDr
    Copper Contributor
    Mar 01, 2024

    DavidEngelMS 

     

    I feel my voice is probably lost at the bottom of the comments list, so would request please that the following needs mentioning in the post...

     

    Updating to the latest OLE/ODBC drivers stopped SQL Server Agent working on SQL Server 2019.

    The service wouldn't start once the server was rebooted, nor was the logs table available.  We tried multiple workarounds from various forums, but to no avail (not nice in a high-pressure environment!). 

     

    We had to install the exact driver version mentioned in this post (instead of newer ones released since), otherwise SQL Agent simply would not start.

     

    I hope this saves others from the morning I've just had (and thanks MrKD for your distant support).

  • DavidEngelMS's avatar
    DavidEngelMS
    Icon for Microsoft rankMicrosoft
    Mar 01, 2024

    EvilDr 

     

    We had to install the exact driver version mentioned in this post (instead of newer ones released since)

    I'm not sure what newer ones you are referring to since the ones in this post are currently the latest release.

     

    Make sure you keep the same driver major version installed that came with SQL Server or you will run into issues. Different major versions can be installed side-by-side and applications reference specific major versions. I recommend contacting Microsoft Support to help you troubleshoot your issue.

     

    Regards,

    David

  • EvilDr's avatar
    EvilDr
    Copper Contributor
    Mar 04, 2024

    Hi DavidEngelMS 

     

    Thanks for your reply.

     

    I'm not sure what newer ones you are referring to since the ones in this post are currently the latest release.

    18.3.2 caused SQL Server Agent to fail.  Installing 17.10.5 worked perfectly.

     

    Make sure you keep the same driver major version installed that came with SQL Server or you will run into issues. Different major versions can be installed side-by-side and applications reference specific major versions

    This must've been the issue, which we were unaware of.  I'm not sure if this is a widely-known fact for the more experienced users...??