PT-2016-7268 · Microsoft · Sql Server 2016+2

Publicado 2016-11-08 · Atualizado 2018-10-12 · CVE-2016-7252

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server 2016

Description The issue is related to the improper handling of the FILESTREAM path in Microsoft SQL Analysis Services, which can lead to an information disclosure. This can be exploited by an attacker with access to an affected SQL server database, potentially allowing them to gain additional database and file information.

Recommendations For Microsoft SQL Server 2016, apply the necessary security updates to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2016-7252

Produtos afetados

Sql Server Analysis Services

Sql Server 2016

Sql Server

Referências · 5

• http://securitytracker.com/id/1037250 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-7252 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-7252 · Aviso do Fabricante
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-136 · Aviso do Fabricante
• http://securityfocus.com/bid/94050 · Nota