Patch Lady – SQL patching in August

Topic

New Reply

I’ve seen this come up a bit in forums and other venues: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8273 In that post
[See the full post at: Patch Lady – SQL patching in August]

Susan Bradley Patch Lady/Prudent patcher

5 users thanked author for this post.

woody, abbodi86, columbia2011, mcbsys, Elly

Reply | Quote

Replies

Going to need a very-wide-screen monitor to display Pinnochio’s nose properly if this keeps happening.

1 user thanked author for this post.

BobbyB

Reply | Quote

The nose might be so long that Pinocchio’s head will be tilted downward.

Reply | Quote

As an MS SQL DBA for many years I would expect that this was discovered in the cloud as there is no acknowledgment by an individual or group.

Also with the rapid updating of SQL 2014/2016/2017 builds it shows something when the released updates appear to be this one fix added to the latest Cumulative Update. This means that it has been discovered and patched quickly. The next 2017 CU would normally be the week after Patch Tuesday. As always the SQL team offer little information when a security fix comes out.

I doubt that it is also in SQL 2014 as it would have a been referenced.

Reply | Quote

Beware the 2006 SP2 CU build 5161 has now been disabled because they left some unwanted bits in the released build. See https://blogs.msdn.microsoft.com/sqlreleaseservices/issue-with-security-update-for-the-remote-code-execution-vulnerability-in-sql-server-2016-sp2-cu-august-14-2018/

1 user thanked author for this post.

columbia2011

Reply | Quote

Just to prove that this doesn’t affect SQL 2014 the latest 2014 SP2 CU came out without any reference to the critical bug.

Reply | Quote