Vulnerability Description
The agent in Microsoft SQL Server 2012 SP2, 2012 SP3, 2014 SP1, 2014 SP2, and 2016 does not properly check the atxcore.dll ACL, which allows remote authenticated users to gain privileges via unspecified vectors, aka "SQL Server Agent Elevation of Privilege Vulnerability."
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Sql Server | 2012 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/94056Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1037250
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-13
- http://www.securityfocus.com/bid/94056Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1037250
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-13
FAQ
What is CVE-2016-7253?
CVE-2016-7253 is a vulnerability with a CVSS score of 8.8 (HIGH). The agent in Microsoft SQL Server 2012 SP2, 2012 SP3, 2014 SP1, 2014 SP2, and 2016 does not properly check the atxcore.dll ACL, which allows remote authenticated users to gain privileges via unspecifi...
How severe is CVE-2016-7253?
CVE-2016-7253 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-7253?
Check the references section above for vendor advisories and patch information. Affected products include: Microsoft Sql Server.