PT-2016-7270 · Microsoft · Sql Server

Published 2016-11-08 · Updated 2018-10-12 · CVE-2016-7254

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft SQL Server versions 2012 SP2 through 2012 SP3

Description The issue arises from improper handling of pointer casting, allowing remote authenticated users to gain elevated privileges. An attacker with access to an affected SQL server database could exploit this to view, change, or delete data, or create new accounts.

Recommendations For Microsoft SQL Server 2012 SP2, update to a version that properly handles pointer casting to prevent elevation of privilege. For Microsoft SQL Server 2012 SP3, update to a version that properly handles pointer casting to prevent elevation of privilege.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2016-7254

Affected Products

Sql Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-7254 · Security Note
• https://osv.dev/vulnerability/CVE-2016-7254 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-136 · Vendor Advisory
• http://securitytracker.com/id/1037250 · Note
• http://securityfocus.com/bid/94061 · Note