CVE-2016-7270

The Data Provider for SQL Server in Microsoft .NET Framework 4.6.2 mishandles a developer-supplied key, which allows remote attackers to bypass the Always Encrypted protection mechanism and obtain sensitive cleartext information by leveraging key guessability, aka ".NET Information Disclosure Vulnerability."
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
microsoft.net_framework
4.6.2
𝑥
= Vulnerable software versions
Windows Releases
Platform
Version
Windows 10
1607 (x64, x86)
KB3206632
Windows 7
Service Pack 1 (x64, x86)
KB3204805
Windows 8.1
(x64, x86)
KB3204802
Windows Server 2008 R2
Service Pack 1 (x64)
KB3204805
Service Pack 1 Server Core (x64)
KB3204805
Windows Server 2012
Server Core
KB3204801
Standard
KB3204801
Windows Server 2012 R2
Server Core
KB3204802
Standard
KB3204802
Windows Server 2016
Server Core
KB3206632
Standard
KB3206632
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/94741
http://www.securitytracker.com/id/1037455
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-155
http://www.securityfocus.com/bid/94741
http://www.securitytracker.com/id/1037455
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-155