Microsoft Security Bulletin MS09-004 – Important

• For your joy (and especially for the joy of my customer :)) yesterday Microsoft has released a new Security Bulletin for SQL Server:

•  

• Microsoft Security Bulletin MS09-004 – Important

• https://www.microsoft.com/technet/security/bulletin/MS09-004.mspx

•  

• This update is marked as important, which stands for: “A vulnerability whose exploitation could result in compromise of the confidentiality, integrity, or availability of users data, or of the integrity or availability of processing resources”.

•  

• Systems with SQL Server 7.0 Service Pack 4, SQL Server 2005 Service Pack 3, and SQL Server 2008 are not affected by this issue.

•  

• This update will take your implementations at the following build levels:

• -          SQL 2005 SP2: 3077 (GDR) or 3310 (QFE).

• Please note the security update is not included in CU11, which is on build 3301.

• Next cumulative update for SQL Server 2005 (ie, CU 12 ETA mid Feb) will include this GDR.

• -          SQL Server 2000 SP4: 2282 (QFE).

•  

• For future reference, The Severity Rating System defines the following levels for vulnerabilities:

•  

• Rating	Definition
  Critical	A vulnerability whose exploitation could allow the propagation of an Internet worm without user action.
  Important	A vulnerability whose exploitation could result in compromise of the confidentiality, integrity, or availability of users data, or of the integrity or availability of processing resources.
  Moderate	Exploitability is mitigated to a significant degree by factors such as default configuration, auditing, or difficulty of exploitation.
  Low	A vulnerability whose exploitation is extremely difficult, or whose impact is minimal.

•  

• - Beatrice Nicolini -