轉發 台灣電腦網路危機處理暨協調中心 資安訊息警訊 TWCERTCC-200-202511-00000010

[內容說明]
微軟針對旗下產品SQL Server發布重大資安漏洞公告(CVE-2025-59499，CVSS：8.8)，此漏洞為SQL注入漏洞，允許經授權的攻擊者透過網路注入精心設計的SQL指令並提升權限。

[影響平台]
● Microsoft SQL Server 2019 (GDR) 15.0.0 至 15.0.21552版本
● Microsoft SQL Server 2016 Service Pack 3 (GDR) 13.0.0 至130.6475.1版本
● Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack 13.0.0 至 13.0.7070.1 版本
● Microsoft SQL Server 2017 (CU 31) 14.0.0 至 14.0.3515.1版本
● Microsoft SQL Server 2022 (GDR) 16.0.0 至 16.0.1160.1版本
● Microsoft SQL Server 2019 (CU 32) 15.0.0.0 至 15.0.4455.2版本
● Microsoft SQL Server 2022 (CU 21) 16.0.0.0 至 16.0.4222.2 版本
● Microsoft SQL Server 2017 (GDR) 14.0.0 至 14.0.2095.1版本

[建議措施]
根據官方網站釋出解決方式進行修補：
https://msrc.microsoft.com/update-guide/zh-tw/vulnerability/CVE-2025-59499

[參考資料]
https://www.twcert.org.tw/tw/cp-169-10506-e0a1e-1.html

Forwarded from Taiwan Computer Network Crisis Management and Coordination Center: Cybersecurity Alert TWCERTCC-200-202511-00000010

[Content Description]
Microsoft has released a critical cybersecurity vulnerability bulletin for its SQL Server product (CVE-2025-59499, CVSS: 8.8). This vulnerability is an SQL injection vulnerability, allowing authorized attackers to inject carefully crafted SQL commands over a network and escalate privileges.

[Affected Platforms]
● Microsoft SQL Server 2019 (GDR) versions 15.0.0 to 15.0.21552
● Microsoft SQL Server 2016 Service Pack 3 (GDR) versions 13.0.0 to 130.6475.1
● Microsoft SQL Server 2016 Service Pack 3 Azure Connect Feature Pack versions 13.0.0 to 13.0.7070.1
● Microsoft SQL Server 2017 (CU 31) versions 14.0.0 to 14.0.3515.1
● Microsoft SQL Server 2022 (GDR) versions 16.0.0 to 16.0.1160.1
● Microsoft SQL Server 2019 (CU 32) versions 15.0.0.0 to 15.0.4455.2
● Microsoft SQL Server Versions 2022 (CU 21) 16.0.0.0 to 16.0.4222.2
● Microsoft SQL Server 2017 (GDR) Versions 14.0.0 to 14.0.2095.1

[Recommended Action]
Patch according to the solutions released on the official website:
https://msrc.microsoft.com/update-guide/zh-tw/vulnerability/CVE-2025-59499

[Reference]
https://www.twcert.org.tw/tw/cp-169-10506-e0a1e-1.html