A New SQL Server Vulnerability

This week I was at VS Live, which was a great conference in Austin. They have a few more around the country, and I'll be at the Redmond one, but they are a small, fun, multi-tech software conference with lots of development and a few data topics. After prepping for my sessions, I logged into mail and saw a bunch of new SQL Server patches, all of them seemingly addressing a new potential attack vector.

The CVE-2022-29143 issue is a potential SQL Server remote code execution vulnerability that could be serious, but has a high level of complexity and isn't likely to be a problem. That being said, when there is a potential security issue, Microsoft takes it seriously and works on building a patch quickly. They've released this patch for all versions of SQL Server from 2014-2019.

Apply this patch.

There are two patches for each version, one being a specific patch level and one a GDR. If you don't know the difference on which one to apply, you ought to learn, and then patch your systems  up to the latest CU so you can just apply a patch like this when it's released.

Keeping up with patches can be a pain, and certainly it is a task that makes some of us nervous. It's also hard when third party software vendors don't certify their wares on different SQL Server versions. I'd like to think the CU process makes this simpler and easier, and most software that works on RTM will also work on CU17. However, you need to test, and you should have a process in place to test and apply patches.

There are no shortage of stories where someone delayed patching and then a vulnerability was exploited. Don't be that person. Work on getting your systems patched.

Steve Jones - SSC Editor

Join the debate, and respond to the editorial on the forums

If you can test and evaluate databases, and database objects, at every phase of the database development lifecycle, then you are much more likely to be able to adopt continuous delivery. The further down the delivery pipeline that bugs appear, the more costly in time and resources they are to fix.

SQL Monitor works with your SQL Server data, wherever that data exists, from local instances to AWS RDS and AWS virtual machines. You can keep an eye on your estate, regardless of where the data is.

The T-SQL DBCC, acronym for “Database Console Command”, is a command that performs several types of tasks. These tasks are mainly of the validation and maintenance type. Some of the... The...

    Reading the SQL Server Error Log is important when troubleshooting many issues for SQL Server. Some example issues would be errors related to Always On Availability Groups,...

In this article, we will explore some internal working principles of SQL Server statistics. What is Cardinality Estimator (CE)? The Cardinality Estimator (CE) is the core subunit of the...

When 2 or more workers are modifying the same row, it is possible to encounter 13535.  The time of the begin transaction and the modification are the defining properties. ...

Lets see how to join 2 table with a parameterized on condition in PySpark

The Azure SQL Database Portal team recently launch...

In the first article High Availability in Azure SQL Managed Instance: General Purpose service tier we have described the principles behind the High Availability and dived into the specifics...

Getting started with Azure Synapse Analytics or Az...

Google is quickly trying to squash any talk about LaMDA being sentient.

Storage Accounts are pretty much integrated into s...

Azure CLI is really handy for all sorts of tasks. When I build solutions, POCs and environments and I want to tear down the resources I like to use... The...

Microsoft, in conjunction with Principle Technologies recently produced a benchmark, comparing the performance of Azure SQL Managed Instance, and Amazon RDS SQL Server. I normally really dislike these benchmarks—it...

In this episode of Data Exposed: SQL Insider Series, Anna Hoffman and Nadia Ben El Kadi review the main SQL Migration tools and explain which tool is best suited...

Lets review steps to restore an Azure SQL database...

Introduction  In today's blog article, we will try to address and clarify some points on how Azure SQL DB and Managed Instance Point in Time Restore (PiTR) works, especially when...

SQL Server Central Editor, Steve Jones is joined by a panel of industry experts from around the globe to discuss their experiences with digital transformation, and the impact it had on themselves, their teams and the wider organization.

Join Grant Fritchey to discover how automating your database deployments enables you to speed up software delivery with repeatable processes that stop your database being the bottleneck.

Want to get a flavor of the type of quality training sessions offered at PASS Data Community Summit? Dive into the full video library from Summit 2021 of over 250 sessions. Take your pick from sessions covering the following themes, Reach for the Clouds, Level Up and Back to Basics, presented by top data experts from around the world.

One of the most overlooked features of SQL Server is the CTE which not only simplifies the query, but gives you the ability to do things that would otherwise...

PowerShell users can use the Invoke-Webrequest, Ne...

Sometimes I find remembering where a particular server sends its backups to a nightmare. You might have servers backing up to different locations, you might have different locations for...

The lawsuit alleges Facebook’s Pixel tracking tool redirects patient communications and other “secure” information without authorization.

Joe Celko explains how several mathematical concepts, combinations, permutations, and derangements, relate to databases

Note: "Setting Matters Straight" is a new format: ...

Using a change management system for database code is a new idea for many database administrators. Grant Fritchey explains the many benefits of database change control.

In this third article we continue building Distributed Availability Groups to migrate SQL Server databases to a different Active Directory domain.

We rank the best gaming chairs from budget seats t...

Intel debuted the details of its 'Intel 4' process...

HP’s Omen 27u is a 27-inch IPS Ultra HD monitor ...

CLOSINGBALANCEMONTH: Evaluates the specified expression for the date corresponding to the end of the current month. https://dax.guide/closingbalancemonth/ CLOSINGBALANCEQUARTER: Evaluates the specified expression for the date corresponding to the end...

STARTOFMONTH: Returns the start of month. https://dax.guide/startofmonth/ STARTOFQUARTER: Returns the start of quarter. https://dax.guide/startofquarter/ STARTOFYEAR: Returns the start of year. https://dax.guide/startofyear/ ENDOFMONTH: Returns the end of month. https://dax.guide/endofmonth/ ENDOFQUARTER:...

Microsoft has acknowledged a new known issue causing the Wi-Fi...

Microsoft and Elire Group will use Project Silica ...

Microsoft Teams is getting a new update that enables users...

Stored functions in MySQL return a scalar value and can be used in a SQL statement. In this article, Robert Sheldon explains how to create and use a MySQL stored function.

Wayback Machine SQL Server query plans have had, forever, pretty generic reasons embedded in the XML for why your query was prevented from going parallel. Not for things like it not...

The purpose of this article is to provide insights into how parameter sniffing occurs for an ad-hoc query and how it affects their performance. Case Study: Untouchable legacy code...

In this article we look at how to add custom page ...

In this blog post I am going to demonstrate how to...

Need some help optimizing your Power BI Dataset bu...

Have you ever wanted to publish from Power BI Desktop to a different organization? External Users publishing!!! Adam shows you how you can log in as an external user...

Power BI field parameters are a new feature in Power BI Desktop, and it’s one of the best of the past months. In short, Power BI field parameters allow... The...

If you try to use SELECTEDVALUE on the visible col...

If you’re working with DirectQuery in Power BI then one of the most important properties you can set on your dataset is the “Maximum connections per data source” property....

SSIS Catalog Compare 2022 (Beta) is available at ...

Data Masker for SQL Server is a product that helps to change data for compliance purposes. It works well, but it isn’t intuitive in a few ways. We bought... The...

Automate alerts, orchestrate business workflows an...

As announced on December 2019, After January 31st ...

We recently released an update to Microsoft Driver...

How to analyze tabular data using Java Streams and Python Pandas. As well as compare how they perform and scale for large amounts of data.

Knowing how to write API requests and handle their responses is a valuable skill that a developer, data engineer or data analyst/scientist needs to know. In this short blog I share how its possible leverage DuckDuckGo’s instant answer API to create a oracle which can answer (some) of your questions using the httr package and Shiny.

The Security Update for SQL Server 2014 SP3 GDR is...

The Security Update for SQL Server 2019 RTM CU16 i...

The Security Update for SQL Server 2019 RTM GDR is...

The Security Update for SQL Server 2017 RTM CU29 i...

The Security Update for SQL Server 2017 RTM GDR is...

The Security Update for SQL Server 2016 SP3 GDR is...

The Security Update for SQL Server 2016 SP2 CU17 i...

The Security Update for SQL Server 2016 SP2 GDR is...

The Security Update for SQL Server 2014 SP3 CU4 is...

I had a problem at work recently where a record wa...

Nohup is a command which prevents commands / scripts from stopping should we close a terminal window / SSH session.

Most of the attacks involve the use of automated exploits, security vendor says.

As organizations get wise to common types of social engineering attacks, criminals are bound to get craftier. Here’s how a criminal could put a new spin on a classic...

The annual report is always filled with useful security information. Here are several of the most important lessons from this year's edition.

Reading Time: 2 minutes For this months T-SQL Tue...

I talk about why I prefer CONVERT over CAST to be ...

Edition #151 of T-SQL Tuesday is hosted by Mala Ma...

Introduction This month’s T-SQL Tuesday is being...

It’s another T-SQL Tuesday! This month, Mala Mah...

One of my favorite people, Malathi Mahadevan (blog...

This month’s T-SQL Tuesday invitation comes from...

I’ve written before about building your own moni...

If you’re using Git for source code management, you may...

Microsoft-owned GitHub is getting ready to retire Atom, an open-source...

The Date_Bucket function is introduced in Azure SQL Edge which is mainly used by IoT devices. This useful function returns the date-time value corresponding to the start of each date-time bucket from the timestamp defined by the origin parameter, or the default origin value of 1900-01-01 00:00:00.000. In other words, it lets you arrange data into groups that represent fixed intervals of time. SQL Server 2022 includes this useful function in its database engine.

Another post for me that is simple and hopefully s...

Use SELECT statements to query a MySQL database. In this article, Robert Sheldon explains how. … The post Introducing the MySQL SELECT statement appeared first on Simple Talk.

In this article learn about the basics of SQL INSERT statements along with several different examples of how to insert data into SQL Server tables.

Added to SQL Server in 2008 Steve explains and demonstrates how to set up row constructor. Transcription of video: So there’s this thing called a row constructor. And this...

Azure Data Explorer is a big data interactive analytics platform that empowers people to make data driven decisions in a highly agile environment. The factors listed below can help assess if Azure Data Explorer is a good fit for the workload at hand. These are the key questions to ask yourself.

Make It Or Not I’m gonna be honest with you, dear reader, because without honesty we’ve got nothing. Except lies — which you know — those can be comforting sometimes. Hm....

As a continuation from the day before, here is the multiple CTE’s in a query demo. Transcription of the demo: All right. So here’s an example of a simple...

            The Date_Bucket function is introduced in Azure SQL Edge which is mainly used by IoT devices. This useful function returns the date-time value corresponding...

Fun With KQL - Distinct

In this article we look at how to import and expor...

We are excited to share that Notebook Views are av...

Hello community, the June release of Azure Data Studio 1.37 is here! We are also excited to announce the release of SQL Server Management Studio (SSMS) 18.12. In this...