question

basit 1 avatar image
basit 1 asked

MS14-044 Vulnerability Still coming after Applying SQL Server 2008 R2 SP3

Hello , We have update one of our server with SQL Server 2008 SP4. Our information Security team infomed us that SQL Vulnerability MS14-044 has been detected. I have checked and found this Vulnerability is for SP3 version, it has been fixed by applying QFE(2977319) or GDR (2977320). It also said if we update the system with latest service pack SP, this Vulnerability will be removed. Please let me know even after applying the SP4 why this Vulnerability is coming. Thanks & Regards Basit K
sql-server-2008-r2sp3
4 comments
10 |1200
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

KenJ avatar image KenJ commented ·
This vulnerability is specifically listed as one of the two items fixed by SP3 - http://support.microsoft.com/kb/2979597 Is there any chance that you have another instance on the machine? What is returned by `SELECT @@Version` ?
0 Likes 0 ·
basit 1 avatar image basit 1 commented ·
We have only one instance on this server and that we have upgrade to SP3 in this Dec 14 after getting this vulnerability. The report is come from some Qualis Tool that run again on 30 Jan 2015
0 Likes 0 ·
KenJ avatar image KenJ commented ·
What is your build number from `SELECT @@Version`
0 Likes 0 ·
basit 1 avatar image basit 1 commented ·
the server was SQL server 2008 update with latest patch SP4. It was my mistake initially i mention SQL Server 2008 R2 SP3. The Build number is : 9.00.5000.00
0 Likes 0 ·

1 Answer

·
Fatherjack avatar image
Fatherjack answered
OK, there seems to be a lot of confusion over what version of SQL Server you are running. Your question title says SQL Server 2008 R2, in the question itself you say SQL Server 2008 and you declare that the results of @@VERSION is 9.00.5000 which is SQL Server 2005. If you have 2005 sp4 (ie 9.00.5000.00) then it is in extended support and wont have any further service packs provided. It is however listed as a non-affected version on https://technet.microsoft.com/en-us/library/security/ms14-044.aspx. You can reference which version is which at http://support.microsoft.com/kb/321185.
10 |1200
Toggle Comment visibility. Current Visibility: Viewable by all users

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.

Write an Answer

Hint: Notify or tag a user in this post by typing @username.

Up to 2 attachments (including images) can be used with a maximum of 512.0 KiB each and 1.0 MiB total.