Microsoft SQL Server 2012 SP2 and 2012 SP3 does not properly perform a cast of an unspecified pointer, which allows remote authenticated users to gain privileges via unknown vectors, aka "SQL RDBMS Engine Elevation of Privilege Vulnerability."

The remote Microsoft SQL Server is missing a security update. It is, therefore, affected by multiple vulnerabilities :

  - Multiple elevation of privilege vulnerabilities exist     in the SQL RDBMS Engine due to improper handling of     pointer casting. An authenticated, remote attacker can     exploit these to gain elevated privileges.
    (CVE-2016-7249, CVE-2016-7250, CVE-2016-7254)

  - A cross-site scripting (XSS) vulnerability exists in     the SQL server MDS API due to improper validation of a     request parameter on the SQL server site. An     unauthenticated, remote attacker can exploit this, via     a specially crafted request, to execute arbitrary code     in the user's browser session. (CVE-2016-7251)

  - An information disclosure vulnerability exists in     Microsoft SQL Analysis Services due to improper     validation of the FILESTREAM path. An authenticated,     remote attacker can exploit this to disclose sensitive     database and file information. (CVE-2016-7252)

  - An elevation of privilege vulnerability exists in the     Microsoft SQL Server Engine due to improper checking by     the SQL Server Agent of ACLs on atxcore.dll. An     authenticated, remote attacker can exploit this to gain     elevated privileges. (CVE-2016-7253)

The remote host is running a version of Microsoft SQL Server 2012 SP3 11.0.6020.0 through 11.0.6247.0 and is affected by multiple privilege escalation vulnerabilities :

 - A flaw exists in the SQL Server Agent that is triggered as ACLs on 'atxcore.dll' are not properly checked. This may allow an authenticated attacker to gain elevated privileges. (CVE-2016-7253)
 - A flaw exsts in the RDBMS engine that is triggered during the handling of pointer casting. This may allow an authenticated attacker to gain elevated privileges. (CVE-2016-7254)

The remote host is running a version of Microsoft SQL Server 2012 SP2 11.0.5058.0 through 11.0.5387.0 and is affected by multiple privilege escalation vulnerabilities :

 - A flaw exists in the SQL Server Agent that is triggered as ACLs on 'atxcore.dll' are not properly checked. This may allow an authenticated attacker to gain elevated privileges. (CVE-2016-7253)
 - A flaw exsts in the RDBMS engine that is triggered during the handling of pointer casting. This may allow an authenticated attacker to gain elevated privileges. (CVE-2016-7254)

ID	Name	Product	Family	Severity
122484	MS16-136: Security Update for SQL Server (3199641) (uncredentialed check)	Nessus	Windows	high
9811	Microsoft SQL Server 2012 SP3 11.0.6020.0 through 11.0.6247.0 Multiple Privilege Escalation (3194721)	Nessus Network Monitor	Database	medium
9810	Microsoft SQL Server 2012 SP2 11.0.5058.0 through 11.0.5387.0 Multiple Privilege Escalation (3194719)	Nessus Network Monitor	Database	medium
94637	MS16-136: Security Update for SQL Server (3199641)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2016-7254

high

Tenable Plugins

high

medium

medium

high