MS12-070：SQL Server の脆弱性により、特権が昇格される (2754849)
2012年10月24日
危険度: : 高
CVE識別番号: CVE-2012-2552
概要
This patch addresses a vulnerability existing in Microsoft SQL Server on systems with SQL Server Reporting Services (SSRS). It is a cross-site scripting vulnerability that could allow attackers to execute arbitrary commands on the SSRS site. A remote attacker can exploit this vulnerability by sending a specially crafted link to the users. Moreover, attackers can host a web page that can exploit this vulnerability.
トレンドマイクロの対策
詳しい情報については以下のサイトをご参照ください。
影響を受けるソフトウェア
- Microsoft SQL Server 2008 R2 for x64-based Systems Service Pack 1
- Microsoft SQL Server 2008 R2 for Itanium-based Systems Service Pack 1
- Microsoft SQL Server 2012 for x64-based Systems
- Microsoft SQL Server 2005 Express Edition with Advanced Services Service Pack 4
- Microsoft SQL Server 2005 for 32-bit Systems Service Pack 4
- Microsoft SQL Server 2005 for x64-based Systems Service Pack 4
- Microsoft SQL Server 2005 for Itanium-based Systems Service Pack 4
- Microsoft SQL Server 2008 for 32-bit Systems Service Pack 2
- Microsoft SQL Server 2008 for 32-bit Systems Service Pack 3
- Microsoft SQL Server 2008 for x64-based Systems Service Pack 2
- Microsoft SQL Server 2008 for x64-based Systems Service Pack 3
- Microsoft SQL Server 2008 for Itanium-based Systems Service Pack 2
- Microsoft SQL Server 2008 for Itanium-based Systems Service Pack 3
- Microsoft SQL Server 2008 R2 for 32-bit Systems Service Pack 1
- Microsoft SQL Server 2012 for 32-bit Systems