There has been quite a bit of media coverage about the WannaCrypt\/WannaCry ransomware over the past several days. Microsoft has a new page<\/a> with information about this particular issue and steps that can be taken to protect your systems. I have also collected some more detailed background information about this and about SQL Server security patching in general. <\/p>\n

Just to be clear, there is no known threat to SQL Server from this method, but there was an out of band security update for SQL Server 2012, 2014, and 2016 that was released on November 8, 2016<\/a>. Here are the most current cumulative updates for SQL Server 2012, 2014, and 2016 (which will include that security update). <\/p>\n

\n

SQL Server 2012<\/strong>              SQL Server 2012 SP3 CU9<\/a>            11.0.6598.0                      May 15, 2017 <\/p>\n

SQL Server 2014<\/strong>              SQL Server 2014 SP2 CU5<\/a>            12.0.5546.0                      April 17, 2017 <\/p>\n

SQL Server 2016<\/strong>              SQL Server 2016 SP1 CU3<\/a>            13.0.4435.0                      May 15, 2017<\/p>\n<\/blockquote>\n

  <\/p>\n

WannaCrypt\/WannaCry Information<\/b> <\/p>\n

Here are some links to useful resources about this outbreak. Making sure your servers and client machines are current with their Microsoft Update hotfixes and possibly disabling SMB v1 are the best defenses. <\/p>\n

\n

Alert (TA17-132A) Indicators Associated With WannaCry Ransomware<\/a> <\/p>\n

Microsoft Security Bulletin MS17-010 \u2013 Critical<\/a> <\/p>\n

MS17-010: Description of the security update for Windows SMB Server: March 14, 2017<\/a> <\/p>\n

Windows Update Catalog Download Links<\/a><\/p>\n<\/blockquote>\n

<\/b>  <\/p>\n

SMB v1 Information<\/b> <\/p>\n

Another mitigation measure for this vulnerability is to disable Server Message Block (SMB) v1 (which has been deprecated since Windows Server 2012). Depending on what version of Windows Server you are running, you may be able to do this using various methods. <\/p>\n

\n

The Deprecation of SMB1 \u2013 You should be planning to get rid of this old SMB dialect<\/a> <\/p>\n

Stop using SMB1<\/a> <\/p>\n

How to enable and disable SMBv1, SMBv2, and SMBv3 in Windows and Windows Server<\/a><\/p>\n<\/blockquote>\n

  <\/p>\n

SQL Server Security Update Information<\/b> <\/p>\n

Microsoft now recommends proactively installing SQL Server Cumulative Updates as they become available. The most recent, specific security update (MS16-136) for SQL Server 2012, 2014, and 2016 was released on November 8, 2016. If you are up to date with your SQL Server Service Packs and Cumulative Updates, you will already have that SQL Server security update. Just to be clear, there is no indication that SQL Server is vulnerable to WannaCry. It is merely a best practice to stay current with SQL Server security and other updates. <\/p>\n

\n

Announcing updates to the SQL Server Incremental Servicing Model (ISM)<\/a> <\/p>\n

Where to find information about the latest SQL Server builds<\/a> <\/p>\n

MS16-136: Security update for SQL Server: November 8, 2016<\/a><\/p>\n<\/blockquote>\n

  <\/p>\n

Finally, there are a number of other good reasons to make an effort to keep your SQL Server instances up to date with the latest Service Pack and Cumulative Update. I highlight some of the more important hotfixes for every cumulative update in the blog posts linked below: <\/p>\n

\n

Performance and Stability Related Fixes in Post-SQL Server 2012 SP3 Builds<\/a><\/p>\n

Performance and Stability Related Fixes in Post-SQL Server 2014 SP1 Builds<\/a><\/p>\n

Performance and Stability Related Fixes in Post-SQL Server 2014 SP2 Builds<\/a><\/p>\n

Performance and Stability Related Fixes in Post-SQL Server 2016 SP1 Builds<\/a><\/p>\n<\/blockquote>\n","protected":false},"excerpt":{"rendered":"

There has been quite a bit of media coverage about the WannaCrypt\/WannaCry ransomware over the past several days. Microsoft has a new page with information about this particular issue and steps that can be taken to protect your systems. I have also collected some more detailed background information about this and about SQL Server security […]<\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13,343,31,156,246],"tags":[344,346,345],"class_list":["post-1185","post","type-post","status-publish","format-standard","hentry","category-sql-server-cumulative-updates","category-security","category-sql-server-2012","category-sql-server-2014","category-sql-server-2016","tag-security","tag-wannacry","tag-wannacrypt"],"yoast_head":"\n