KB3194961 - db_name() and db_id() functions fail to trigger permissions check in SQL Server

Support

Hello,

Select a different account.

You have multiple accounts

Choose the account you want to sign in with.

Applies To

SQL Server 2014 Developer - duplicate (do not use) SQL Server 2014 Enterprise - duplicate (do not use) SQL Server 2014 Enterprise Core - duplicate (do not use) SQL Server 2014 Standard - duplicate (do not use)

Symptoms

When you execute the db_name() or db_id() function in an instance of SQL Server, permissions are not checked as expected. Therefore, the data that's returned may contain information that you don't have permissions for.

Resolution

This issue is fixed in the following cumulative update for SQL Server:

Cumulative Update 2 for SQL Server 2014 Service Pack 2

Each new cumulative update for SQL Server contains all the hotfixes and all the security fixes that were included with the previous cumulative update. Check out the latest cumulative updates for SQL Server:

Latest cumulative update for SQL Server 2014

Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

References

For information about the permissions that are required for these functions, see the DB_NAME (Transact-SQL) and DB_ID (Transact-SQL) topics on MSDN.Learn about the terminology that Microsoft uses to describe software updates.