PT-2016-7269 · Microsoft · Sql Server

Published 2016-11-08 · Updated 2018-10-12 · CVE-2016-7253

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server versions 2012 SP2 through 2016

Description The issue arises from the SQL Server Agent's failure to properly check the atxcore.dll ACL, allowing remote authenticated users to gain privileges. An attacker could exploit this issue if their credentials allow access to an affected SQL server database, potentially gaining elevated privileges to view, change, or delete data, or create new accounts.

Recommendations For Microsoft SQL Server 2012 SP2, update to a version that properly checks the atxcore.dll ACL to prevent elevation of privilege. For Microsoft SQL Server 2012 SP3, update to a version that properly checks the atxcore.dll ACL to prevent elevation of privilege. For Microsoft SQL Server 2014 SP1, update to a version that properly checks the atxcore.dll ACL to prevent elevation of privilege. For Microsoft SQL Server 2014 SP2, update to a version that properly checks the atxcore.dll ACL to prevent elevation of privilege. For Microsoft SQL Server 2016, update to a version that properly checks the atxcore.dll ACL to prevent elevation of privilege.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2016-7253

Affected Products

Sql Server

References · 5

• https://osv.dev/vulnerability/CVE-2016-7253 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-136 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-7253 · Security Note
• http://securitytracker.com/id/1037250 · Note
• http://securityfocus.com/bid/94056 · Note