Hi,

MS08-052 has an SQL2005 component that is fixed in CU9 (build 3282). I have
not seen very much about the SQL part of this security bulletin but it looks
like it is Reporting Services that is affected.

We have Reporting Services installed and are running it under a low
permissions account. Will we have a big security hole by not upgrading to
CU9 after we just went to CU7?

Thanks

Chris

It addresses an issue in GDI+ that happens to be a part of a lot of MS
Applications, including the report viewer in SQL Server. It's
probably worth the trouble to installl it.

http://support.microsoft.com/kb/954593

Thanks Eric.

It's more detailed information on this problem that I need. At this time I
need to know that what I have in place is good enough protection without
upgrading my servers again as I cannot get anyone to test the upgrade.

So am I right in that I am reducing the attack vector by running Reporting
Services with a low level account could be enough protection? I like to get
my servers fully patched but in this case I cannot do so quickly.

Thanks

Chris



"Eric Isaacs" <eisaacs@gmail.com> wrote in message
news:cfc6ecdb-5573-46df-815f-7a056f9e99fd@r15g2000prh.googlegroups.com...
> It addresses an issue in GDI+ that happens to be a part of a lot of MS
> Applications, including the report viewer in SQL Server. It's
> probably worth the trouble to installl it.
>
> http://support.microsoft.com/kb/954593
>