Microsoft Security Bulletin MS09-004 – Important
For your joy (and especially for the joy of my customer :)) yesterday Microsoft has released a new Security Bulletin for SQL Server:
Microsoft Security Bulletin MS09-004 – Important
http://www.microsoft.com/technet/security/bulletin/MS09-004.mspx
This update is marked as important, which stands for: “A vulnerability whose exploitation could result in compromise of the confidentiality, integrity, or availability of users data, or of the integrity or availability of processing resources”.
Systems with SQL Server 7.0 Service Pack 4, SQL Server 2005 Service Pack 3, and SQL Server 2008 are not affected by this issue.
This update will take your implementations at the following build levels:
- SQL 2005 SP2: 3077 (GDR) or 3310 (QFE).
Please note the security update is not included in CU11, which is on build 3301.
Next cumulative update for SQL Server 2005 (ie, CU 12 ETA mid Feb) will include this GDR.
- SQL Server 2000 SP4: 2282 (QFE).
For future reference, The Severity Rating System defines the following levels for vulnerabilities:
|
Rating |
Definition |
|
Critical |
A vulnerability whose exploitation could allow the propagation of an Internet worm without user action. |
|
Important |
A vulnerability whose exploitation could result in compromise of the confidentiality, integrity, or availability of users data, or of the integrity or availability of processing resources. |
|
Moderate |
Exploitability is mitigated to a significant degree by factors such as default configuration, auditing, or difficulty of exploitation. |
|
Low |
A vulnerability whose exploitation is extremely difficult, or whose impact is minimal. |
- Beatrice Nicolini -
