Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I just noticed that many servers use Microsoft SQL server 2000. But isn't 2000 outdated by 2003? Why are people still using 2000? Would there be any serious security vulnerability by using Microsoft SQL server 2000 sp3a? (MSSQL 8.00.766.00)? What would be the point of running SQL server 2000 in Windows 7 enterprise?

share|improve this question
2  
It's not always easy to upgrade software - or price could be an issue as well. – ekaj Jul 23 '12 at 0:29
Oh no that would be nonsense for you to struggle with the 12 year old bugs. Compatibility depends on how the app is written. Most often you can port the SQL and underlying procedures, views and permissions no issues but if you have 1000 tables in this, you need to take a month to do it. – Andrew Smith Jul 23 '12 at 6:38
1  
Coding might take a month but testing is a much longer process. If you have an app written in 1999 that has been running for this long, the SQL bugs are well-known and the app has reached a certain level of stability. Upgrading is not a trivial task in this instance, especially if it is a business-critical application. Things can break that can be nearly impossible to properly trace and the costs of errors are huge. – schroeder Jul 23 '12 at 14:15
Add to the fact that most companies might not have teams with the knowledge and capabilities to deal with such upgrading issues. – Terry Chia Jul 23 '12 at 15:13
Maybe you dont need to port everything, depends on the apps, sql server 2000 is outdated for cloud of windows 7 servers, it's better to run this on free windows xp, doesnt make difference, just to switch the firewall on so you are safe until 2014 ;-) – Andrew Smith Jul 24 '12 at 21:52
show 1 more comment

2 Answers

up vote 4 down vote accepted

There could be a few factors.

Like ekaj stated, price could be a prohibitive factor as some companies might not be able to afford or justify the cost of upgrading to the newer version, particularly if they do not take security threats seriously.

Another factor could be the need for backward compatibility. I do not have experience with the Microsoft SQL server, so it might not apply in this particular case, but sometimes upgrading software can break compatibility with existing products/solutions. The company in question might not have the people with the right expertise to ensure that the upgrade does not have any compatibility issues.

A quick search of CVE databases turns up a few potential vulnerabilities which may or may not be serious enough to warrant an upgrade.

share|improve this answer
up vote 2 down vote

Some applications will only work in MSSQL 2K - new commands and functions behave differently and can break older applications written on 2K. Even changes in DATE formats can cause problems.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.