PT-2016-7269 · Microsoft · Sql Server

Publicado 2016-11-08 · Atualizado 2018-10-12 · CVE-2016-7253

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server versions 2012 SP2 through 2016

Description The issue arises from the SQL Server Agent's failure to properly check the atxcore.dll ACL, allowing remote authenticated users to gain privileges. An attacker could exploit this issue if their credentials allow access to an affected SQL server database, potentially gaining elevated privileges to view, change, or delete data, or create new accounts.

Recommendations For Microsoft SQL Server 2012 SP2, update to a version that properly checks the atxcore.dll ACL to prevent elevation of privilege. For Microsoft SQL Server 2012 SP3, update to a version that properly checks the atxcore.dll ACL to prevent elevation of privilege. For Microsoft SQL Server 2014 SP1, update to a version that properly checks the atxcore.dll ACL to prevent elevation of privilege. For Microsoft SQL Server 2014 SP2, update to a version that properly checks the atxcore.dll ACL to prevent elevation of privilege. For Microsoft SQL Server 2016, update to a version that properly checks the atxcore.dll ACL to prevent elevation of privilege.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2016-7253

Produtos afetados

Sql Server

Referências · 5

• http://securitytracker.com/id/1037250 · Nota
• http://securityfocus.com/bid/94056 · Nota
• https://osv.dev/vulnerability/CVE-2016-7253 · Aviso do Fabricante
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-136 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-7253 · Nota de Segurança