Detections
Analytics
Microsoft SQL Server 2014 12.0.x.x < 12.0.2381.0 Multiple Vulnerabilities (2977316)
medium Nessus Network Monitor Plugin ID 9705
Synopsis
The remote host is running a version SQL Server that is vulnerable to multiple attack vectors.Description
The remote host is running a version of Microsoft SQL Server 2014 prior to 12.0.2381.0 and is affected by multiple vulnerabilities :- A flaw exists in Master Data Services (MDS) that allows a reflected cross-site scripting (XSS) attack. This flaw exists because the program does not validate input before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2014-1820)
- An overflow condition is triggered as user-supplied input is not properly validated when handling a specially crafted T-SQL query. This may allow a local attacker to cause a stack-based buffer overflow, resulting in a denial of service. (CVE-2014-4061)
Solution
Update to SQL Server 2014 12.0.2381.0 or higher.See Also
https://technet.microsoft.com/en-us/library/security/ms14-044.aspx
Plugin Details
Severity: Medium
ID: 9705
Family: Database
Published: 10/21/2016
Updated: 3/6/2019
Risk Information
VPR
Risk Factor: Low
Score: 3.4
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5.9
Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 6.2
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:X/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:microsoft:sql_server:2014
Patch Publication Date: 8/12/2014
Vulnerability Publication Date: 8/12/2014
Reference Information
CVE: CVE-2014-1820, CVE-2014-4061