SQL Clone
SQLServerCentral is supported by Redgate
Log in  ::  Register  ::  Not logged in

It's Time to Patch and Upgrade

By Steve Jones,

I don't want to be chicken little here, but the Meltdown/Spectre bugs have me concerned. I don't know the scope of the vulnerabilities, as far as exploits go, but I do know the lax ways in which humans interact with machines, including running code, opening untrusted documents, and just making silly mistakes. No matter how careful you think you are, can you be sure everyone else in your organization is just as careful? Are you sure they won't do something silly from a database server? Or do something from a server (or workstation) that has access to a database server? Or use a browser (yes, there's an exploit)

PATCH your system, soon.

Vulernabilities in hardware are no joke, and even if you think you're fairly safe, it's silly to let this one go by and assume you won't get hit. The advent of widely deployed scripting tools, botnets, and more mean that you never know what crazy mechanism might end up getting to your database server. Is it really worth allowing this when you can patch a system? This is a no brainer, a simple decision. Just schedule the patches. With all the news and media, I'm sure you can get some downtime approved in the next few weeks. After all, your management wouldn't want to explain to their customers any data loss from this any more than you'd want to explain it to your boss.

We've got a page at SQLServerCentral that summarizes the links I've found for information, patches, etc. I'm sure things will change rapidly, and I'll update the article as I get more information. The important things to note are that not all OSes have patches yet, and there are situations where you might not need to change anything. That's good, as there are some preliminary reports of patches causing issues with performance (degrading it) for PostgreSQL And MongoDB systems. I did see this tweet about no effects on SQL Server, which is good, but YMMV.

Most of us know patching matters, and we need to do it periodically (even if it's a pain), however, many of you are like me in that you rarely upgrade systems. Once they work, and because I have plenty of other tasks, I don't look to necessarily upgrade a database platform for years. One downside to that is that a major vulnerability like the Meltdown/Spectre attacks is that patches likely won't come out for old system and versions of SQL Server. That is the case here.

That means that if you're on SQL 2005-, or even on older Windows OSes, you might really consider planning an upgrade. Even if you aren't overly worried about this exploit, you won't want a vulnerability to live for a long time in your environment. You never know when a firewall will change, server will move, or some malware will slip through (did I mention the browser exploit?). Plan on an upgrade. I've started asking about accelerating our upgrade plans, and you might think about that as well. I know management doesn't want to spend money unneceesarily, but this feels necessary, and a good time to refresh your system to a supported version.

In general I like to delay my patches slightly from the world and not be on the bleeding edge. That's fine, but don't wait too long with this one. I would hope that most people get systems patched in the next month. If not, don't expect any sympathy if you lose data.

Total article views: 76 | Views in the last 30 days: 1
Related Articles


sql upgrades and windows patch upgrades


Don't Upgrade to SQL Server 2005

It's been almost three years since SQL Server 2005 was released and Steve Jones current recommendati...


Patch Week

This week Steve Jones notes there were quite a few patches from Microsoft for a variety of products....


SP2 Patching

SQL Server SP2 patching process


SQL Server Patching

How often to do the SQL Server Patching, like quaterly patching done by Oracle