SQL SERVER – 2005 – Two Important Security Update

If you are using SQL Server 2005, following two are very important security updates not to be missed. Please apply each security update as soon as you can.

Security Update for SQL Server 2005 Service Pack 2 (KB948108)

A security issue has been identified in the SQL Server 2005 Service Pack 2 that could allow an attacker to compromise your system and gain control over it.

Security Update for SQL Server 2005 Service Pack 2 (KB948109)

A security issue has been identified in the SQL Server 2005 Service Pack 2 that could allow an attacker to compromise your system and gain control over it.

How I Apply a Security Update to SQL Server

Security fixes are the updates I never like to leave waiting, but I also never install them blind. A patch that stops a production server at the wrong moment causes its own outage. So I follow the same simple routine every time:

• Read the support article first. It tells you which builds the fix applies to, whether a restart is needed, and any known issues.
• Check the current build with SELECT @@VERSION, so you know the patch fits your server.
• Install it on a test server with the same version and service pack, and run your usual jobs and reports against it.
• Take full backups of the user databases and of the system databases master, msdb and model before you patch production.
• Plan a maintenance window and tell the users. The install restarts the SQL Server service.
• After the install, run the version query again and confirm the build number changed.

These two fixes were for SQL Server 2005 Service Pack 2, which is long out of support, and there are no new fixes for it. If you still run SQL Server 2005, the only real protection is to upgrade to a supported version. For current versions, Microsoft releases security fixes and cumulative updates on a regular basis, and the routine above works for all of them.

I also keep a simple log of every patch: the date, the server, the build before and after, and who installed it. When something odd happens a week later, that log is the first place I look.

Published by Pinal Dave on SQLAuthority. More of my work at pinaldave.com.