PT-2015-2771 · Microsoft · Sql Server

Published 2015-07-14 · Updated 2018-10-12 · CVE-2015-1761

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014

Description The issue is related to incorrect casting of pointers, which can be exploited by remote authenticated users to gain elevated privileges. This can be achieved by leveraging certain write access. An attacker who successfully exploits this issue could gain elevated privileges, allowing them to view, change, or delete data, or create new accounts.

Recommendations For Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2015-12136

CVE-2015-1761

Affected Products

Sql Server

References · 8

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-058 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-1761 · Security Note
• https://bdu.fstec.ru/vul/2015-12136 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1761 · Security Note
• http://technet.microsoft.com/security/bulletin/ms15-058 · Note
• http://technet.microsoft.com/security/bulletin/MS15-058 · Note
• http://securitytracker.com/id/1032893 · Note
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05382740 · Note