Full Disclosure mailing list archives
SQL Server patch - why doesn't Windows update help?
From: Darren Reed <avalon () coombs anu edu au>
Date: Fri, 31 Jan 2003 02:30:05 +1100 (Australia/ACT)
I was just thinking to myself, hmmm, I have SQL Server something* installed on one of my Win2K boxes (service is turned off), I wonder if I have this patched as I do regular checkups with "Windows Update"... Well, either I haven't or I have and the "Windows Update" web site is lieing and "Add/Remove Programs" is in league with it. Strange. I do a scan with "Windows Update" and it still doesn't pick it up. It doesn't show up under "Office Update" either. What gives ? I ask myself have I been deceived into thinking that this "Windows Update" was not doing as I expected and is in fact doing far less ? I wonder how many other people do regular updates, using "Windows Update" and expect it to catch all of the patches required for their system(s) and don't give it much further thought ? The catch I now find myself in is if "Windows Update" doesn't know it should have installed the hotfix for SQL Server, how the hell am I (or anyone else for that matter) meant to now work out what has and hasn't been applied that is relevant ? How much trust can I now put in the "Windows Update" service to deliver me the correct patches that my system needs ? I wonder if I would have been one of the unsuspecting masses that got infiltrated if I had of been trusting "Windows Update" to keep my 'net exposed SQL servers up to date ?! Maybe this is a "known bug" or "caveat" with "Windows Update" but if it is, it'd sure be nice if it behaved as expected - read the "About Windows Update" sometime. I don't think I've got unreasonable expectations, based on how they advertise the service, that this should have been patched for me, already! I wonder if you'd have a case for suing Microsoft for damages if you got hit and used their update service on a regular basis, with it failing to install the patch, leading to you being crompromised for (if nothing else) false advertising of the "Windows Update" service capabilities... Darren * - it is one of the versions advertised as being vulnerable and no, there are no copyright problems with the installed products. p.s. This is the kind of email that now gets censored from bugtraq, I just hope it's appropriate for full-disclosure... _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- SQL Server patch - why doesn't Windows update help? Darren Reed (Jan 30)
- RE: SQL Server patch - why doesn't Windows update help? Jason Coombs (Jan 30)
- <Possible follow-ups>
- Re: SQL Server patch - why doesn't Windows update help? Curt Wilson (Jan 30)
- Re: SQL Server patch - why doesn't Windows update help? Darren Reed (Jan 30)