PT-2016-7268 · Microsoft · Sql Server 2016+2

Published 2016-11-08 · Updated 2018-10-12 · CVE-2016-7252

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server 2016

Description The issue is related to the improper handling of the FILESTREAM path in Microsoft SQL Analysis Services, which can lead to an information disclosure. This can be exploited by an attacker with access to an affected SQL server database, potentially allowing them to gain additional database and file information.

Recommendations For Microsoft SQL Server 2016, apply the necessary security updates to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-7252

Affected Products

Sql Server Analysis Services

Sql Server 2016

Sql Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-7252 · Security Note
• https://osv.dev/vulnerability/CVE-2016-7252 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-136 · Vendor Advisory
• http://securitytracker.com/id/1037250 · Note
• http://securityfocus.com/bid/94050 · Note