The remote Microsoft SQL Server is missing a security update. It is, therefore, affected by multiple vulnerabilities :

  - Multiple elevation of privilege vulnerabilities exist     in the SQL RDBMS Engine due to improper handling of     pointer casting. An authenticated, remote attacker can     exploit these to gain elevated privileges.
    (CVE-2016-7249, CVE-2016-7250, CVE-2016-7254)

  - A cross-site scripting (XSS) vulnerability exists in     the SQL server MDS API due to improper validation of a     request parameter on the SQL server site. An     unauthenticated, remote attacker can exploit this, via     a specially crafted request, to execute arbitrary code     in the user's browser session. (CVE-2016-7251)

  - An information disclosure vulnerability exists in     Microsoft SQL Analysis Services due to improper     validation of the FILESTREAM path. An authenticated,     remote attacker can exploit this to disclose sensitive     database and file information. (CVE-2016-7252)

  - An elevation of privilege vulnerability exists in the     Microsoft SQL Server Engine due to improper checking by     the SQL Server Agent of ACLs on atxcore.dll. An     authenticated, remote attacker can exploit this to gain     elevated privileges. (CVE-2016-7253)

Detections

Analytics

MS16-136: Security Update for SQL Server (3199641)

high Nessus Plugin ID 94637

Version 1.14