A CTP for SQL Server 2008 Service Pack 3 is available
Yesterday Microsoft made available Community Technology Preview (CTP) of Service Pack 3 for SQL Server 2008. This allows you to test the service pack in your test or QA environments before deploying the eventual final release, and also to provide feedback to Microsoft about potential issues with the service pack. The build number is 10.00.5416.
You can download the CTP here (most likely you'll want the big file for your platform, named SQLServer2008SP3-KB2546945-[platform]-ENU.exe):
If you are using Express, the link is here:
You can see the list of fixes in KB #2546945:
And you can read the Release Services blog for more information.
This includes fixes from SP2 Cumulative Updates 1, 2, 3 and 4, but the updates from CU5 (KB #2555408) are *not* included. If you are relying on specific fixes from that build, you should hold off on installing any version of SP3 until the first post-SP3 cumulative update is available.
Note: the SP3 CTP is for SQL Server 2008 only. It is *NOT* for SQL Server 2008 R2. If SELECT @@VERSION returns 10.50.xxxx, please do not waste time downloading this update.
Well, it's all about timing. The branch for SP3 was peeled off the main before CU5 (and the security issue) came about. Hindsight is 20/20 – if they knew about the security issue before they forked, I'm sure they would have delayed and/or included it.
Remember this is just a CTP – you shouldn't be applying it immediately to production / vulnerable instances anyway. And when the real service pack comes out, as was shown with the recent SP for 2008 R2, an out-of-band catch-me-up cumulative update should be released very soon afterward.
And besides, I think the whole security patch was way over-sensationalized in the first place. When was the last time you had a .disco file try to steal information from your servers? In other words – you don't necessarily need the patch to secure your environment.
You know it really amazes me that Microsoft did not include CU5. That is the first build AFTER the WSUS patch – kinda seems important one would think.