Schweregrad: : Alto
  Identificador(es) CVE: : CVE-2012-2552
  Data do informe: 24 outubro 2012

  Descrição

This patch addresses a vulnerability existing in Microsoft SQL Server on systems with SQL Server Reporting Services (SSRS). It is a cross-site scripting vulnerability that could allow attackers to execute arbitrary commands on the SSRS site. A remote attacker can exploit this vulnerability by sending a specially crafted link to the users. Moreover, attackers can host a web page that can exploit this vulnerability.

  Solução

  Software infectado e versão:

  • Microsoft SQL Server 2008 R2 for x64-based Systems Service Pack 1
  • Microsoft SQL Server 2008 R2 for Itanium-based Systems Service Pack 1
  • Microsoft SQL Server 2012 for x64-based Systems
  • Microsoft SQL Server 2005 Express Edition with Advanced Services Service Pack 4
  • Microsoft SQL Server 2005 for 32-bit Systems Service Pack 4
  • Microsoft SQL Server 2005 for x64-based Systems Service Pack 4
  • Microsoft SQL Server 2005 for Itanium-based Systems Service Pack 4
  • Microsoft SQL Server 2008 for 32-bit Systems Service Pack 2
  • Microsoft SQL Server 2008 for 32-bit Systems Service Pack 3
  • Microsoft SQL Server 2008 for x64-based Systems Service Pack 2
  • Microsoft SQL Server 2008 for x64-based Systems Service Pack 3
  • Microsoft SQL Server 2008 for Itanium-based Systems Service Pack 2
  • Microsoft SQL Server 2008 for Itanium-based Systems Service Pack 3
  • Microsoft SQL Server 2008 R2 for 32-bit Systems Service Pack 1
  • Microsoft SQL Server 2012 for 32-bit Systems