FIX: Information disclosure when you create a session cube by using dynamic role-based security in SQL Server 2012 or SQL Server 2014

Consider the following scenario:
  • You implement dynamic security for an Analysis Services database in Microsoft SQL Server 2012 or SQL Server 2014.
  • You add a logon ID (domain\username) to a database role that has denied access to a specific dimension member.
  • You connect to the database by specifying the given logon ID and the database role in the connection string.
  • You create a session cube based on an existing cube that you have read access to.
In this scenario, when you execute a query to retrieve data from the session cube, the result may contain data that you do not have permission to access.
The issue was first fixed in the following cumulative update of SQL Server: Recommendation: Install the latest cumulative update for SQL Server
Each new cumulative update for SQL Server contains all the hotfixes and all the security fixes that were included with the previous cumulative update. We recommend that you download and install the latest cumulative updates for SQL Server:
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.


Article ID: 3080856 - Last Review: 10/19/2015 18:58:00 - Revision: 2.0

Microsoft SQL Server 2012 Service Pack 2, Microsoft SQL Server 2012 Business Intelligence, Microsoft SQL Server 2012 Analysis Services, Microsoft SQL Server 2014 Service Pack 1, Microsoft SQL Server 2014 Developer, Microsoft SQL Server 2014 Enterprise, Microsoft SQL Server 2014 Standard

  • kbqfe kbsurveynew kbfix kbexpertiseadvanced KB3080856