PT-2015-2771 · Microsoft · Sql Server

Publicado 2015-07-14 · Atualizado 2018-10-12 · CVE-2015-1761

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014

Description The issue is related to incorrect casting of pointers, which can be exploited by remote authenticated users to gain elevated privileges. This can be achieved by leveraging certain write access. An attacker who successfully exploits this issue could gain elevated privileges, allowing them to view, change, or delete data, or create new accounts.

Recommendations For Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

BDU:2015-12136

CVE-2015-1761

Produtos afetados

Sql Server

Referências · 8

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-058 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-1761 · Nota de Segurança
• http://technet.microsoft.com/security/bulletin/ms15-058 · Nota
• https://bdu.fstec.ru/vul/2015-12136 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1761 · Nota de Segurança
• http://technet.microsoft.com/security/bulletin/MS15-058 · Nota
• http://securitytracker.com/id/1032893 · Nota
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05382740 · Nota