KLA11083 Information Disclosure vulnerability in Microsoft SQL Server

An incorrect enforcement of permissions was found in Microsoft SQL Server Analysis Services. By exploiting this vulnerability malicious users can obtain sensitive information.

Technical details

This vulnerability can be exploited in case an affected SQL server database can be accessed using the attacker’s credentials.

Original advisories

CVE-2017-8516

Related products

Microsoft-SQL-Server

CVE list

CVE-2017-8516 warning

KB list

4019092

4019090

4019091

4032542

4019093

4036996

4019088

4019086

4019089

4019095

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

Affected Products

• Microsoft SQL Server 2012 Service Pack 3Microsoft SQL Server 2014 Service Pack 1Microsoft SQL Server 2016