KB3080856 - FIX: Information disclosure when you create a session cube by using dynamic role-based security in SQL Server 2012 or SQL Server 2014

Symptoms

Consider the following scenario:

  • You implement dynamic security for an Analysis Services database in Microsoft SQL Server 2012 or SQL Server 2014.

  • You add a logon ID (domain\username) to a database role that has denied access to a specific dimension member.

  • You connect to the database by specifying the given logon ID and the database role in the connection string.

  • You create a session cube based on an existing cube that you have read access to.

In this scenario, when you execute a query to retrieve data from the session cube, the result may contain data that you do not have permission to access.

Resolution

The issue was first fixed in the following cumulative update of SQL Server:

Each new cumulative update for SQL Server contains all the hotfixes and all the security fixes that were included with the previous cumulative update. We recommend that you download and install the latest cumulative updates for SQL Server:


Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

Need more help?

Expand your skills
Explore Training
Get new features first
Join Microsoft Insiders

Was this information helpful?

Thank you for your feedback!

Thank you for your feedback! It sounds like it might be helpful to connect you to one of our Office support agents.

×