Microsoft Security Bulletin MS16-136 - Important

Security Update for SQL Server (3199641)

Published: November 8, 2016

Version: 1.0

This security update resolves vulnerabilities in Microsoft SQL Server. The most severe vulnerabilities could allow an attacker could to gain elevated privileges that could be used to view, change, or delete data; or create new accounts. The security update addresses these most severe vulnerabilities by correcting how SQL Server handles pointer casting.

This security update is rated Important for supported editions of Microsoft SQL Server 2012 Service Packs 2 and 3, Microsoft SQL Server 2014 Service Packs 1 and 2, and Microsoft SQL Server 2016. For more information, see the Affected Software section.

For more information about the vulnerabilities, see the Vulnerability Information section.

For more information about this update, see Microsoft Knowledge Base Article 3199641.

The following software has been tested to determine which versions or editions are affected. Other versions or editions are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, see Microsoft Support Lifecycle.

Affected Software 

GDR Software Updates

Cumulative Software Updates

Maximum Security Impact

Aggregate Severity Rating

SQL Server 2012 Service Pack 2

Microsoft SQL Server 2012 for 32-bit Systems Service Pack 2
(3194719)

Microsoft SQL Server 2012 for 32-bit Systems Service Pack 2
(3194725)

Elevation of Privilege

Important

Microsoft SQL Server 2012 for x64-based Systems Service Pack 2
(3194719)

Microsoft SQL Server 2012 for x64-based Systems Service Pack 2
(3194725)

Elevation of Privilege

Important

SQL Server 2012 Service Pack 3

Microsoft SQL Server 2012 for 32-bit Systems Service Pack 3
(3194721)

Microsoft SQL Server 2012 for 32-bit Systems Service Pack 3
(3194724)

Elevation of Privilege

Important

Microsoft SQL Server 2012 for x64-based Systems Service Pack 3
(3194721)

Microsoft SQL Server 2012 for x64-based Systems Service Pack 3
(3194724)

Elevation of Privilege

Important

SQL Server 2014 Service Pack 1

Microsoft SQL Server 2014 Service Pack 1 for 32-bit Systems
(3194720)

Microsoft SQL Server 2014 Service Pack 1 for 32-bit Systems
(3194722)

Elevation of Privilege

Important

Microsoft SQL Server 2014 Service Pack 1 for x64-based Systems
(3194720)

Microsoft SQL Server 2014 Service Pack 1 for x64-based Systems
(3194722)

Elevation of Privilege

Important

SQL Server 2014 Service Pack 2

Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems
(3194714)

Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems
(3194718)

Elevation of Privilege

Important

Microsoft SQL Server 2014 Service Pack 2 for x64-based Systems
(3194714)

Microsoft SQL Server 2014 Service Pack 2 for x64-based Systems
(3194718)

Elevation of Privilege

Important

SQL Server 2016

Microsoft SQL Server 2016 for x64-based Systems
(3194716)

Microsoft SQL Server 2016 for x64-based Systems
(3194717)

Elevation of Privilege

Important

There are GDR and/or CU (Cumulative Update) updates offered for my version of SQL Server. How do I know which update to use? 
First, determine your SQL Server version number. For more information on determining your SQL Server version number, see Microsoft Knowledge Base Article 321185.

Second, in the table below, locate your version number or the version range that your version number falls within. The corresponding update is the one you need to install.

Note If your SQL Server version number is not represented in the table below, your SQL Server version is no longer supported. Please upgrade to the latest Service Pack or SQL Server product in order to apply this and future security updates.

Update number

Title

Apply if current product version is…

This security update also includes servicing releases up through…

3194719

MS16-136: Description of the security update for SQL Server 2012 SP2 GDR: November 8, 2016

11.0.5058.0 - 11.0.5387.0

MS15-058

3194725

MS16-136: Description of the security update for SQL Server 2012 SP2 CU: November 8, 2016

11.0.5500.0 - 11.0.5675.0

SQL Server 2012 SP2 CU15

3194721

MS16-136: Description of the security update for SQL Server 2012 Service Pack 3 GDR: November 8, 2016

11.0.6020.0 - 11.0.6247.0

SQL Server 2012 SP3

3194724

MS16-136: Description of the security update for SQL Server 2012 Service Pack 3 CU: November 8, 2016

11.0.6300.0 - 11.0.6566.0

SQL Server 2012 SP3 CU6

3194720

MS16-136: Description of the security update for SQL Server 2014 Service Pack 1 GDR: November 8, 2016

12.0.4100.0 - 12.0.4231.0

Important Update for SQL Server 2014 SP1 (KB3070446)

3194722

MS16-136: Description of the security update for SQL Server 2014 Service Pack 1 CU: November 8, 2016

12.0.4400.0 - 12.0.4486.0

SQL Server 2014 SP1 CU9

3194714

MS16-136: Description of the security update for SQL Server 2014 Service Pack 2 GDR: November 8, 2016

12.0.5000.0 - 12.0.5202.0

SQL Server 2014 SP2

3194718

MS16-136: Description of the security update for SQL Server 2014 Service Pack 2 CU: November 8, 2016

12.0.5400.0 - 12.0.5531.0

SQL Server 2014 SP2 CU2

3194716

MS16-136: Description of the security update for SQL Server 2016 GDR: November 8, 2016

13.0.1605.0 - 13.0.1721.0

Critical Update for SQL Server 2016 Analysis Services (KB3179258)

3194717

MS16-136: Description of the security update for SQL Server 2016 CU: November 8, 2016

13.0.2100.0 - 13.0.2182.0

SQL Server 2016 CU3


For additional installation instructions, see the Security Update Information subsection for your SQL Server edition in the Update Information section.

What are the GDR and CU update designations and how do they differ? 
The General Distribution Release (GDR) and Cumulative Update (CU) designations correspond to the two different update servicing branches in place for SQL Server. The primary difference between the two is that CU branches cumulatively include all updates for a given baseline, while GDR branches include only cumulative critical updates for a given baseline. A baseline can be the initial RTM release or a Service Pack.

For any given baseline, either the GDR or CU branch updates are options if you are at the baseline or have only installed a previous GDR update for that baseline. The CU branch is the only option if you have installed a previous SQL Server CU for the baseline you are on.

Will these security updates be offered to SQL Server clusters? 
Yes. The updates will also be offered to SQL Server 2012 SP2/SP3, SQL Server 2014 SP1/SP2, and SQL Server 2016 RTM instances that are clustered. Updates for SQL Server clusters will require user interaction.

If the SQL Server 2012 SP2/SP3, SQL Server 2014 SP1/SP2, and SQL Server 2016 RTM cluster has a passive node, to reduce downtime, Microsoft recommends that you scan and apply the update to the inactive node first, then scan and apply it to the active node. When all components have been updated on all nodes, the update will no longer be offered.

Can the security updates be applied to SQL Server instances on Windows Azure (IaaS)? 
Yes. SQL Server instances on Windows Azure (IaaS) can be offered the security updates through Microsoft Update, or customers can download the security updates from Microsoft Download Center and apply them manually.

The following severity ratings assume the potential maximum impact of the vulnerability. For information regarding the likelihood, within 30 days of this security bulletin's release, of the exploitability of the vulnerability in relation to its severity rating and security impact, please see the Exploitability Index in the November bulletin summary.

Vulnerability Severity Rating and Maximum Security Impact by Affected Software

Affected Software

SQL RDBMS Engine EoP vulnerability - CVE-2016-7249

SQL RDBMS Engine EoP vulnerability - CVE-2016-7250

SQL RDBMS Engine EoP vulnerability - CVE-2016-7254

MDS API XSS Vulnerability - CVE-2016-7251

SQL Analysis Services Information Disclosure Vulnerability - CVE-2016-7252

SQL Server Agent Elevation of Privilege Vulnerability - CVE-2016-7253

SQL Server 2012 Service Pack 2

Microsoft SQL Server 2012 for 32-bit Systems Service Pack 2

Not applicable

Not applicable

Important 
Elevation of Privilege

Not applicable

Not applicable

Important 
Elevation of Privilege

Microsoft SQL Server 2012 for x64-based Systems Service Pack 2

Not applicable

Not applicable

Important 
Elevation of Privilege

Not applicable

Not applicable

Important 
Elevation of Privilege

SQL Server 2012 Service Pack 3

Microsoft SQL Server 2012 for 32-bit Systems Service Pack 3

Not applicable

Not applicable

Important 
Elevation of Privilege

Not applicable

Not applicable

Important 
Elevation of Privilege

Microsoft SQL Server 2012 for x64-based Systems Service Pack 3

Not applicable

Not applicable

Important 
Elevation of Privilege

Not applicable

Not applicable

Important 
Elevation of Privilege

SQL Server 2014 Service Pack 1

Microsoft SQL Server 2014 Service Pack 1 for 32-bit Systems

Not applicable

Important 
Elevation of Privilege

Not applicable

Not applicable

Not applicable

Important 
Elevation of Privilege

Microsoft SQL Server 2014 Service Pack 1 for x64-based Systems

Not applicable

Important 
Elevation of Privilege

Not applicable

Not applicable

Not applicable

Important 
Elevation of Privilege

SQL Server 2014 Service Pack 2

Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems

Not applicable

Important 
Elevation of Privilege

Not applicable

Not applicable

Not applicable

Important 
Elevation of Privilege

Microsoft SQL Server 2014 Service Pack 2 for x64-based Systems

Not applicable

Important 
Elevation of Privilege

Not applicable

Not applicable

Not applicable

Important 
Elevation of Privilege

SQL Server 2016

Microsoft SQL Server 2016 for x64-based Systems

Important 
Elevation of Privilege

Important 
Elevation of Privilege

Not applicable

Important 
Elevation of Privilege

Important
Information Disclosure

Not applicable

Multiple SQL RDBMS Engine Elevation of Privilege Vulnerabilities

Elevation of privilege vulnerabilities exist in Microsoft SQL Server when it improperly handles pointer casting. An attacker could exploit the vulnerabilities if their credentials allow access to an affected SQL server database. An attacker who successfully exploited the vulnerabilities could gain elevated privileges that could be used to view, change, or delete data; or create new accounts.

The security update addresses the vulnerabilities by correcting how SQL Server handles pointer casting

The following table contains links to the standard entry for each vulnerability in the Common Vulnerabilities and Exposures list:

Vulnerability title

CVE number

Publicly disclosed

Exploited

SQL RDBMS Engine Elevation of Privilege Vulnerability

CVE-2016-7249

No

No

SQL RDBMS Engine Elevation of Privilege Vulnerability

CVE-2016-7250

No

No

SQL RDBMS Engine Elevation of Privilege Vulnerability

CVE-2016-7254

No

No


Mitigating Factors

Microsoft has not identified any mitigating factors for these vulnerabilities.

Workarounds

The Microsoft has not identified any workarounds for these vulnerabilities.

MDS API XSS Vulnerability- CVE-2016-7251

An XSS elevation of privilege vulnerability exists in SQL Server MDS that could allow an attacker to inject a client-side script into the user's instance of Internet Explorer. The vulnerability is caused when the SQL Server MDS does not properly validate a request parameter on the SQL Server site. The script could spoof content, disclose information, or take any action that the user could take on the site on behalf of the targeted user.

The security update addresses the vulnerability by correcting how SQL Server MDS validates the request parameter.

The following table contains a link to the standard entry for the vulnerability in the Common Vulnerabilities and Exposures list:

Vulnerability title

CVE number

Publicly disclosed

Exploited

MDS API XSS Vulnerability

CVE-2016-7251

No

No


Mitigating Factors

Microsoft has not identified any mitigating factors for this vulnerability.

Workarounds

The Microsoft has not identified any workarounds for this vulnerability.

SQL Analysis Services Information Disclosure Vulnerability– CVE-2016-7252

An information disclosure vulnerability exists in Microsoft SQL Analysis Services when it improperly checks FILESTREAM path. An attacker could exploit the vulnerability if their credentials allow access to an affected SQL server database. An attacker who successfully exploited the vulnerability could gain additional database and file information.

The security update addresses the vulnerability by correcting how SQL Server handles FILESTREAM path.

The following table contains a link to the standard entry for the vulnerability in the Common Vulnerabilities and Exposures list:

Vulnerability title

CVE number

Publicly disclosed

Exploited

SQL Analysis Services Information Disclosure Vulnerability

CVE-2016-7252

No

No


Mitigating Factors

Microsoft has not identified any mitigating factors for this vulnerability

Workarounds

The Microsoft has not identified any workarounds for this vulnerability.

SQL Server Agent Elevation of Privilege Vulnerability– CVE-2016-7253

An elevation of privilege vulnerability exists in Microsoft SQL Server Engine when the SQL Server Agent incorrectly check ACLs on atxcore.dll. An attacker could exploit the vulnerability if their credentials allow access to an affected SQL server database. An attacker who successfully exploited the vulnerability could gain elevated privileges that could be used to view, change, or delete data; or create new accounts.

The security update addresses the vulnerability by correcting how SQL Server Engine handles ACLs.

The following table contains a link to the standard entry for the vulnerability in the Common Vulnerabilities and Exposures list:

Vulnerability title

CVE number

Publicly disclosed

Exploited

SQL Server Agent Elevation of Privilege Vulnerability

CVE-2016-7253

No

No


Mitigating Factors

Microsoft has not identified any mitigating factors for this vulnerability.

Workarounds

The Microsoft has not identified any workarounds for this vulnerability.

Microsoft recognizes the efforts of those in the security community who help us protect customers through coordinated vulnerability disclosure. See Acknowledgments for more information.

The information provided in the Microsoft Knowledge Base is provided "as is" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

  • V1.0 (November 8, 2016): Bulletin published.

Page generated 2016-11-09 08:02-08:00.
Show: