Microsoft SQL Server 2014 SP1, 2014 SP2, and 2016 does not properly perform a cast of an unspecified pointer, which allows remote authenticated users to gain privileges via unknown vectors, aka "SQL RDBMS Engine Elevation of Privilege Vulnerability."

The remote Microsoft SQL Server is missing a security update. It is, therefore, affected by multiple vulnerabilities :

  - Multiple elevation of privilege vulnerabilities exist     in the SQL RDBMS Engine due to improper handling of     pointer casting. An authenticated, remote attacker can     exploit these to gain elevated privileges.
    (CVE-2016-7249, CVE-2016-7250, CVE-2016-7254)

  - A cross-site scripting (XSS) vulnerability exists in     the SQL server MDS API due to improper validation of a     request parameter on the SQL server site. An     unauthenticated, remote attacker can exploit this, via     a specially crafted request, to execute arbitrary code     in the user's browser session. (CVE-2016-7251)

  - An information disclosure vulnerability exists in     Microsoft SQL Analysis Services due to improper     validation of the FILESTREAM path. An authenticated,     remote attacker can exploit this to disclose sensitive     database and file information. (CVE-2016-7252)

  - An elevation of privilege vulnerability exists in the     Microsoft SQL Server Engine due to improper checking by     the SQL Server Agent of ACLs on atxcore.dll. An     authenticated, remote attacker can exploit this to gain     elevated privileges. (CVE-2016-7253)

The remote host is running a version of Microsoft SQL Server 2016 13.0.1605.0 through 13.0.1721.0 and is affected by multiple vulnerabilities :

 - A flaw exists in the RDBMS engine that is triggered during the handling of pointer casting. This may allow an authenticated attacker to gain elevated privileges. (CVE-2016-7249, CVE-2016-7250)
 - A flaw exists that allows a cross-site scripting (XSS) attack. This flaw exists because the MDS API does not validate input before returning it to users. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2016-7251)
 - A flaw exists in the Analysis services that is triggered as FILESTREAM paths are not properly checked. This may allow an authenticated attacker to gain access to sensitive information. (CVE-2016-7252)

The remote host is running a version of Microsoft SQL Server 2014 SP2 12.0.5000.0 through 12.0.5202.0 and is affected by a flaw in the RDBMS engine that is triggered during the handling of pointer casting. This may allow an authenticated attacker to gain elevated privileges.

The remote host is running a version of Microsoft SQL Server 2014 SP1 12.0.4100.0 through 12.0.4231.0 and is affected by a flaw in the RDBMS engine that is triggered during the handling of pointer casting. This may allow an authenticated attacker to gain elevated privileges.

ID	Name	Product	Family	Severity
122484	MS16-136: Security Update for SQL Server (3199641) (uncredentialed check)	Nessus	Windows	high
9814	Microsoft SQL Server 2016 13.0.1605.0 through 13.0.1721.0 Multiple Privilege Escalation (3194716)	Nessus Network Monitor	Database	medium
9813	Microsoft SQL Server 2014 SP2 12.0.5000.0 through 12.0.5202.0 Privilege Escalation (3194714)	Nessus Network Monitor	Database	medium
9812	Microsoft SQL Server 2014 SP1 12.0.4100.0 through 12.0.4231.0 Privilege Escalation (3194720)	Nessus Network Monitor	Database	medium
94637	MS16-136: Security Update for SQL Server (3199641)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2016-7250

high

Tenable Plugins

high

medium

medium

medium

high