Описание
MDS API XSS Vulnerability
A cross-site scripting vulnerability exists in SQL Server MDS that could allow an attacker to inject a client-side script into the user's browser instance. The vulnerability is caused when the SQL Server MDS does not properly validate a request parameter on the SQL Server site. The script could spoof content, disclose information, or take any action that the user could take on the site on behalf of the targeted user.
To exploit the vulnerability, the user must click a specially crafted URL. In an email attack scenario, an attacker could send an email message containing the specially crafted URL to the user in an attempt to convince the user to click it.
The security update addresses the vulnerability by correcting how SQL Server MDS validates the request parameter.
FAQ
There are GDR and/or CU (Cumulative Update) updates offered for my version of SQL Server. How do I know which update to use? First, determine your SQL Server version number. For more information on determining your SQL Server version number, see Microsoft Knowledge Base Article 321185. Second, in the table below, locate your version number or the version range that your version number falls within. The corresponding update is the one you need to install.
Note If your SQL Server version number is not represented in the table below, your SQL Server version is no longer supported. Please upgrade to the latest Service Pack or SQL Server product in order to apply this and future security updates.
| Update number | Title | Apply if current product version is… | This security update also includes servicing releases up through… |
|---|---|---|---|
| 3194719 | MS16-136: Description of the security update for SQL Server 2012 SP2 GDR: November 8, 2016 | 11.0.5058.0 - 11.0.5387.0 | MS15-058 |
| 3194725 | MS16-136: Description of the security update for SQL Server 2012 SP2 CU: November 8, 2016 | 11.0.5500.0 - 11.0.5675.0 | SQL Server 2012 SP2 CU15 |
| 3194721 | MS16-136: Description of the security update for SQL Server 2012 Service Pack 3 GDR: November 8, 2016 | 11.0.6020.0 - 11.0.6247.0 | SQL Server 2012 SP3 |
| 3194724 | MS16-136: Description of the security update for SQL Server 2012 Service Pack 3 CU: November 8, 2016 | 11.0.6300.0 - 11.0.6566.0 | SQL Server 2012 SP3 CU6 |
| 3194720 | MS16-136: Description of the security update for SQL Server 2014 Service Pack 1 GDR: November 8, 2016 | 12.0.4100.0 - 12.0.4231.0 | Important Update for SQL Server 2014 SP1 (KB3070446) |
| 3194722 | MS16-136: Description of the security update for SQL Server 2014 Service Pack 1 CU: November 8, 2016 | 12.0.4400.0 - 12.0.4486.0 | SQL Server 2014 SP1 CU9 |
| 3194714 | MS16-136: Description of the security update for SQL Server 2014 Service Pack 2 GDR: November 8, 2016 | 12.0.5000.0 - 12.0.5202.0 | SQL Server 2014 SP2 |
| 3194718 | MS16-136: Description of the security update for SQL Server 2014 Service Pack 2 CU: November 8, 2016 | 12.0.5400.0 - 12.0.5531.0 | SQL Server 2014 SP2 CU2 |
| 3194716 | MS16-136: Description of the security update for SQL Server 2016 GDR: November 8, 2016 | 13.0.1605.0 - 13.0.1721.0 | Critical Update for SQL Server 2016 Analysis Services (KB3179258) |
| 3194717 | MS16-136: Description of the security update for SQL Server 2016 CU: November 8, 2016 | 13.0.2100.0 - 13.0.2182.0 | SQL Server 2016 CU3 |
For additional installation instructions, see the Security Update Information subsection for your SQL Server edition in the Update Information section.
What are the GDR and CU update designations and how do they differ? The General Distribution Release (GDR) and Cumulative Update (CU) designations correspond to the two different update servicing branches in place for SQL Server. The primary difference between the two is that CU branches cumulatively include all updates for a given baseline, while GDR branches include only cumulative critical updates for a given baseline. A baseline can be the initial RTM release or a Service Pack.
For any given baseline, either the GDR or CU branch updates are options if you are at the baseline or have only installed a previous GDR update for that baseline. The CU branch is the only option if you have installed a previous SQL Server CU for the baseline you are on.
Will these security updates be offered to SQL Server clusters? Yes. The updates will also be offered to SQL Server 2012 SP2/SP3, SQL Server 2014 SP1/SP2, and SQL Server 2016 RTM instances that are clustered. Updates for SQL Server clusters will require user interaction. If the SQL Server 2012 SP2/SP3, SQL Server 2014 SP1/SP2, and SQL Server 2016 RTM cluster has a passive node, to reduce downtime, Microsoft recommends that you scan and apply the update to the inactive node first, then scan and apply it to the active node. When all components have been updated on all nodes, the update will no longer be offered.
Can the security updates be applied to SQL Server instances on Windows Azure (IaaS)? Yes. SQL Server instances on Windows Azure (IaaS) can be offered the security updates through Microsoft Update, or customers can download the security updates from Microsoft Download Center and apply them manually.
Обновления
| Продукт | Статья | Обновление |
|---|---|---|
| Microsoft SQL Server 2016 for x64-based Systems (GDR) | ||
| Microsoft SQL Server 2016 for x64-based Systems (CU) |
Показывать по
Возможность эксплуатации
Publicly Disclosed
Exploited
Latest Software Release
Older Software Release
DOS
EPSS
Связанные уязвимости
Cross-site scripting (XSS) vulnerability in the MDS API in Microsoft SQL Server 2016 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "MDS API XSS Vulnerability."
Cross-site scripting (XSS) vulnerability in the MDS API in Microsoft SQL Server 2016 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "MDS API XSS Vulnerability."
EPSS