MS12-070 : Security Updates for all supported versions of SQL Server
This week there was a security release for all supported versions of SQL Server. Each version has 32-bit and 64-bit patches, and each version has GDR (General Distribution Release) and QFE (Quick-Fix Engineering) patches. GDR should be applied if you are at the base (RTM or SP) build for your version, while QFE should be applied if you have installed any cumulative updates after the RTM or SP build. (More details here.)
SQL Server 2005
- RTM, SP1, SP2, SP3 – not supported
- SP4 – GDR = 9.00.5069, QFE = 9.00.5324
SQL Server 2008
- RTM, SP1 – not supported
- SP2 – GDR = 10.00.4067, QFE = 10.00.4371
- SP3 – GDR = 10.00.5512, QFE = 10.00.5826
SQL Server 2008 R2
- RTM – not supported
- SP1 – GDR = 10.50.2550, QFE = 10.50.2861
- SP2 – not affected
SQL Server 2012
- RTM: GDR = 11.00.2218, QFE = 11.00.2376
- SP1 – not yet supported; should not be affected once SP1 is released.
Now, a couple of oddities you might have noticed:
- The security bulletin mentions something about SQL Server instances with Reporting Services installed. Yet the KB articles for individual updates state that all instances of SQL Server are eligible for the update. And the update does, in fact, update sqlservr.exe and @@VERSION, even for systems where SSRS is not installed. So until there is some clarification on this point, I'm going to treat this as a patch for all instances.
- Both the GDR and QFE KBs for multiple patches state that the preceding cumulative updates are included. I believe this is a copy & paste error and that the cumulative updates for a specific branch are only included with the QFE patch. I will update here if I get any confirmation on this.
Even if they come back and say, whoops, our bad, the KBs should mention it is SSRS only, and the GDRs do not affect sqlservr.exe and do not include the CU updates, I'm still going to apply the patch everywhere. Why? Well, for consistency, I'd rather have all of my instances at @@VERSION = x, than have the SSRS instances at x and the non-SSRS instances at < x.
we are scheduling an upgrade of Reporting Services servers to SP3, 10.00.5512 [Microsoft SQL Server 2008 (SP3) MS12-070 from 10.00.2531 [Microsoft SQL Server 2008 (SP1). will we need to reboot the server after the upgrade?
Microsoft released new cumulative updates for SQL Server
@ Simon
Workaround in case reporting /integration services does not start after patch deployment
Modify registry
Regedit Browse
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control
add registry DWORD Value ServicesPipeTimeout
Modify it with Decimal value 60000
Restart server to have changes to take effect.
Reporting and intgration serivices started
Some of the SQL 2005 servers' reporting service and integration service in my company could not start after applying GDR 5069. I need to uninstall the update and reboot server and the reporting and integration services will be up again.
Hopefully Microsoft will either make a statement or change the KB's. As my site runs QFE CU's we really need to know what we are getting if we apply the update especially on our remaining SQL2005 servers.
Chris
I agree about the fix sending mixed messages.
The GDR should be the fix only (as every previous GDR patch has been as far as I remember) and this breaks with that norm.
Steven, the GDR fixes should *not* contain any of the CU updates. That's kind of the point of them (notice the much lower build number) and the only difference from QFE. So there is some very mixed messaging going on – either the security bulletin should not say it's SSRS only, or the individual KBs should. And if a patch for SSRS also requires patching for the binaries, wouldn't it make sense to install the patch and get the binaries up to date, even if you're not running SSRS now (but might in the future)? Or to keep your non-SSRS instances consistent with the patched instances?
October 9th was Patch Tuesday, I don't think any of these SQL Server Updates appear in Microsoft Update yet, at least on my developer workstation, none do. 🙁
The KB's do say that the security update contains all the updates which are included in CU 'x' to 'xx' which would explain the additional files e.g. sqlservr.exe
@Yalcin I don't think that's necessarily true. The QFE updates include CU fixes, increment @@VERSION and touch sqlservr.exe, even for instances without SSRS installed. Also the KB articles don't mention anything about SSRS, only the security bulletin mentions that. Until I hear otherwise I am treating this as an "all instances" patch with the same type of priority as a cumulative update.
Hi aaron
Did you read The bulletin briefly I think updates are only for instances that have reporting services installation