CVE-2016-7250High

SQL RDBMS Engine Elevation of Privilege Vulnerability

Published
November 8, 2016
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2016-7250 →

📋 Description

An elevation of privilege vulnerability exists in Microsoft SQL Server when it improperly handles pointer casting. An attacker could exploit the vulnerability if the attacker's credentials allow access to an affected SQL server database. An attacker who successfully exploited this vulnerability could gain elevated privileges that could be used to view, change, or delete data; or create new accounts. The security update addresses the vulnerability by correcting how SQL Server handles pointer casting.

🎯 Affected products10

  • Microsoft SQL Server 2014 Service Pack 1 for 32-bit Systems (CU)
  • Microsoft SQL Server 2014 Service Pack 1 for 32-bit Systems (GDR)
  • Microsoft SQL Server 2014 Service Pack 1 for x64-based Systems (CU)
  • Microsoft SQL Server 2014 Service Pack 1 for x64-based Systems (GDR)
  • Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems (CU)
  • Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems (GDR)
  • Microsoft SQL Server 2014 Service Pack 2 for x64-based Systems (CU)
  • Microsoft SQL Server 2014 Service Pack 2 for x64-based Systems (GDR)
  • Microsoft SQL Server 2016 for x64-based Systems (CU)
  • Microsoft SQL Server 2016 for x64-based Systems (GDR)

✅ Remediation

KB3194720 (Security Update) KB3194722 (Security Update) KB3194714 (Security Update) KB3194718 (Security Update) KB3194716 (Security Update) KB3194717 (Security Update)

🔗 References (7)