0

I have received vulnerability on Microsoft SQL server 2008 (RTM)

[high] [1433/tcp/mssql] TLS Version 1.2 Protocol Not Enabled
TLS v1.2 is not enabled on this port.

Already enabled TLS 1.2 on OS level (Windows Server 2008 R2).

below are the details Product version: Microsoft SQL server 2008 (RTM) - 10.0.1600.22(x64) Product level: RTM Product Edition : Express edition(64bit) Whether I need to go for SQL Server 2008 SP4 10.0.6547.0(First build supports TLS 1.2)

Please let me know how to resolve this issue.

1

There is this KB article, which lists the required updates you need to install https://support.microsoft.com/en-us/kb/3135244 , which also lists which updates are needed on the client machines trying to connect to a TLS 1.2 enabled SQL Server.

Also, read http://blogs.sqlsentry.com/aaronbertrand/tls-1-2-support-read-first/ , which lists known problems and caveats. It states

It seems straightforward, but as of today, not all builds will enable you to rush out and convert to TLS 1.2 exclusively

| improve this answer | |
  • Agreed. Upgrading is more trouble than it's worth considering there are no known vulnerabilities in TLS 1.1 so it's a wonder why it's flagged on an audit. Probably worth fighting over. security.stackexchange.com/questions/57878/… – Cody Konior Jun 17 '16 at 11:29
  • Thanks for update, I have verified sql server service(its 2008 and not 2012), below are the details Product version: Microsoft SQL server 2008 (RTM) - 10.0.1600.22(x64) Product level: RTM Product Edition : Express edition(64bit) Whether I need to go for SQL Server 2008 SP4 10.0.6547.0(First build supports TLS 1.2) – Karthik Jun 18 '16 at 13:42
  • Team Can you please suggest on this – Karthik Jun 20 '16 at 8:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.