4

Are there any outstanding (unpatched) security issues for Sql Server 2000?

This isn't really for me: I moved on from Sql Server 2000 long ago. However, when answering questions here and (more likely) on Stack Overflow, I'm in the habit of leaving a comment like the one at this question whenever coming across a Sql Server 2000 question. If you don't want to follow the link, it goes something like this:

Sql Server 2000 is end of life. It no longer gets any patches... not even critical security patches. It's irresponsible to continue using it. Convincing management to upgrade is job #1.

Aide from it being, well, Sql Server 2000, how much an issue is this really? In the year-plus since Sql Server 2000 went EOL, has anything big come up I could point to as a more concrete issue?

I'd look at official documentation, but as this is effectively abandonware I haven't found anything published directly by MS.

  • This is not directly related to your question but people/firm still use SQL Server 2000 because of legacy application which is only supported( this is as far as I have seen) to run against SS 2000. But the firm which runs 2000 has premier support and yes they do get 'help' from MS. But they cannot hold them responsible for anything wrong – Shanky Dec 29 '14 at 18:45
  • 1
    Running a legacy application is one thing. Asking about it on SO (and even here to a lesser degree) implies something that's is still in active development, over which you have some level of control. In these cases, imo it's at worth at least leaving a comment. – Joel Coehoorn Dec 29 '14 at 18:47
  • AFAIK MS has topped releasing any hotfixes,CU,SP and security fixes for SS 2000. But I am not sure how vulnerable it can be – Shanky Dec 29 '14 at 18:49
  • 2
    You won't find out, either. Microsoft doesn't tend to make public issues it discovers but has no intention of fixing. – Aaron Bertrand Dec 29 '14 at 18:52
  • @AaronBertrand That's part of what bothers me. I know that just because I haven't heard about it doesn't mean it hasn't happened or won't happen tomorrow, but the person on the other end who didn't even know Sql Server 2000 is EOL doesn't, and my inability to point to even one reputable technical source on a specific issue damages my credibility if I need to follow up to convince someone that this is a real problem :( – Joel Coehoorn Dec 30 '14 at 3:09
3

Are there any outstanding critical security issues for Sql Server 2000?

Yes, there are no patches available for newly discovered issues like meltdown/spectre

Microsoft only releases security patches for SQL versions that are still supported. Also notice that if you are running a supported SQL version with an unsupported service pack, you MUST upgrade to a supported service pack to have an available security patch.

  • 4057122 Description of the security update for SQL Server 2017 GDR: January 3, 2018
  • 4058562 Description of the security update for SQL Server 2017 RTM CU3: January 3, 2018
  • 4058561 Description of the security update for SQL Server 2016 SP1 CU7: January 3, 2018
  • 4057118 Description of the security update for SQL Server 2016 GDR SP1: January 3, 2018
  • 4058559 Description of the security update for SQL Server 2016 CU: January 6, 2018
  • 4058560 Description of the security update for SQL Server 2016 GDR: January 6, 2018
  • 4057117 Description of the security update for SQL Server 2014 SP2 CU10: January 16, 2018
  • 4057120 Description of the security update for SQL Server 2014 SP2 GDR: January 16, 2018
  • 4057116 Description of the security update for SQL Server 2012 SP4 GDR: January 12, 2018
  • 4057115 Description of the security update for SQL Server 2012 SP3 GDR: January, 2018
  • 4057121 Description of the security update for SQL Server 2012 SP3 CU: January, 2018
  • 4057114 Description of the security update for SQL Server 2008 SP4 GDR: January 6, 2018
  • 4057113 Description of the security update for SQL Server 2008 R2 SP3 GDR: January 6, 2018

Protect SQL Server from attacks on Spectre and Meltdown side-channel vulnerabilities

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.