| ActiveMac | Anonymous | Create a User | Reviews | News | Forums | Advertise |
|
|
|
User Controls |
|
New User |
|
Login |
|
Edit/View My Profile |
|
|
|
|
|
|
|
ActiveMac |
|
Articles |
|
Forums |
|
Links |
|
News |
|
News Search |
|
Reviews |
|
|
|
|
|
|
|
News Centers |
|
Windows/Microsoft |
|
DVD |
|
ActiveHardware |
|
Xbox |
|
MaINTosh |
|
News Search |
|
|
|
|
|
|
|
ANet Chats |
|
The Lobby |
|
Special Events Room |
|
Developer's Lounge |
|
XBox Chat |
|
|
|
|
|
|
|
FAQ's |
|
Windows 98/98 SE |
|
Windows 2000 |
|
Windows Me |
|
Windows "Whistler" XP |
|
Windows CE |
|
Internet Explorer 6 |
|
Internet Explorer 5 |
|
Xbox |
|
DirectX |
|
DVD's |
|
|
|
|
|
|
|
TopTechTips |
|
Registry Tips |
|
Windows 95/98 |
|
Windows 2000 |
|
Internet Explorer 4 |
|
Internet Explorer 5 |
|
Windows NT Tips |
|
Program Tips |
|
Easter Eggs |
|
Hardware |
|
DVD |
|
|
|
|
|
|
|
Latest Reviews |
|
Applications |
|
Microsoft Windows XP Professional |
|
Norton SystemWorks 2002 |
|
|
|
Hardware |
|
Intel Personal Audio Player 3000 |
|
Microsoft Wireless IntelliMouse Explorer |
|
|
|
|
|
|
|
Site News/Info |
|
About This Site |
|
Affiliates |
|
ANet Forums |
|
Contact Us |
|
Default Home Page |
|
Link To Us |
|
Links |
|
Member Pages |
|
Site Search |
|
Awards |
|
|
|
|
|
|
|
Credits |
 |
Repost: Microsoft Security Bulletin MS02-039: Buffer Overruns in SQL Server 2000 Resolution Service Could Enable Code Execution (Q323875) | |
|
||
| Time: 17:27 EST/22:27 GMT | News Source: ActiveWin.com | Posted By: Robert Stein | ||
|
Note, a paltry 58 people clicked this link when we posted this story back in July. Hundreds of people visited Paul T's story of the day about XP SP1 Rumors, though. SQL Server 2000 and MSDE 2000 introduce the ability to host multiple instances of SQL Server on a single physical machine. Each instance operates for all intents and purposes as though it was a separate server. However, the multiple instances cannot all use the standard SQL Server session port (TCP 1433). While the default instance listens on TCP port 1433, named instances listen on any port assigned to them. The SQL Server Resolution Service, which operates on UDP port 1434, provides a way for clients to query for the appropriate network endpoints to use for a particular SQL Server instance. | ||
|
Write Comment
Return to News |
Displaying 1 through 25 of 316 Last | Next |
The time now is
7:49:46 AM
ET.
Any comment problems? E-mail us |
| #1 By 7390 (63.211.44.114) at 1/25/2003 5:44:49 PM |
|
Am I missing something here? Don't you get these updates as part of Windows Update/Auto Update?
If yes then what is there to discuss? |
| #2 By 665 (64.126.91.172) at 1/25/2003 5:49:12 PM |
|
"Note, a paltry 58 people clicked..."
Hmm... is Bob a bit hostile? :) |
| #3 By 3 (62.253.128.7) at 1/25/2003 6:17:21 PM |
| Should be aiming the headling at sprint! |
| #4 By 3465 (65.222.202.173) at 1/25/2003 7:55:46 PM |
|
Your best bet is the subscribe to Product Security Notification.
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/notify.asp |
| #5 By 135 (208.50.206.187) at 1/25/2003 11:35:44 PM |
|
Russ at NTBUGTRAQ pointed out that if you read these bulletins, especially MS02-61 really carefully... you'll notice they mention that even though it's cumulative you need to run this other hotfix first. It's in really really small print. :)
The fact is SQL server patches are horrible. You have to apply them manually... copy these files, these files, then run these scripts. So anybody know off the top of your head how to run scripts against MSDE? Hint: you have to use a command line utility called OSQL. No Query Analyzer for U! http://www.asp.net/msde/default.aspx But let's not just pick on Microsoft. Oracle supplies patches the same way. Hell, even worse... Oracle doesn't know how to do version stamps on DLLs or EXEs, so the only way you have to verify a patch is to check file size and datestamp. People who do datebases for a living just aren't right in the head. :( |
| #6 By 20 (24.243.41.64) at 1/26/2003 12:13:20 AM |
| I say we all blame Paul T. |
| #7 By 135 (208.50.206.187) at 1/26/2003 2:14:26 AM |
|
linuxhippie - Did you actually think that comment was clever? Helpful?
Can you point me to the Secure configuration best practices document on that website? How about security bulletins? Didn't think so. |
| #8 By 5444 (67.1.33.66) at 1/26/2003 4:24:13 PM |
|
niko,
I was on the beta test for sp3, and the only one I worked with was the MSDE so it should have been released as part of the final update. I know I am running the final sp3, but I also got mine on beta place. el |
| #9 By 5444 (67.1.37.38) at 1/27/2003 3:49:05 PM |
|
agree, and that list is short, I will have to find the complete list of programs that silently load MSDE.
that list might as well put Office XP pro and Office 2k pro down also. as it is an option to load MSDE for Access support. Which opens a bigger door as it may be on most office professional installs. BTW Betaplace is directly from MS. just a little earlier than the download site;) I just hadn't checked the download site and was guessing that since final sp3 for MSDE was released around the same time as the final for sql server on Beta place that would be the case on the download site. But beyond that, this shows exactly the issue that several of us have shown concern about. the foxpro installs a instance of the msde. as well as vs.net and I know that developer does also. I am sure that every one of the programs listed make an instance of the program. So lets take a typical development machine. that may or may not be running server. you would have to manually update, vs.net instance, possible the foxpro instance (if foxpro is loaded and more than likely the office intance) the project instance and the visio instance. and the crystal reports instance. miss one and the machine is vulnerable. So one machine you could have 5 instances of MSDE running easily. Some servers I have seen up to 10 instances of MSDE running based on what management software they are running. Not to mention sql server itself. I personally believe that each of the companies should have the responsibility to offer an update for each of their products. But then that is a security policy and upgrade policy that each corporation must deal with. One of the things that the Antitrust case should have done was at least make a coordination of updates between MS and other companies manditory. El |
|
Write Comment
Return to News |
Displaying 1 through 25 of 316 Last | Next |
The time now is
7:49:46 AM
ET.
Any comment problems? E-mail us |
