Use of double quotes in product name kills WSUS SQL query - kills November 2007 WSUS catalog updates - "The WSUS administration console has encountered an unexpected error." - workaround

Jaime Travez let me know about this and it is worth passing on.

WSUS 3.0 administrators take note - if your WSUS servers error out today or tomorrow, read this article here.

If you are looking for a (sort of) quick unofficial workaround, go here.

It makes me wonder about WSUS's SQL sanitizing overall if something as simple as this could break the application. Makes me wonder about SQL injection and other 'bad' things that might be able to run.

I suspect/expect an official fix will come out soon.

Update - 11/13/07 12:30am EST: It looks like they are fixing it.

Posted by Aaron Tiensivu in Microsoft, System Center, Windows OS at 17:44 | Comments (3) | Trackbacks (0)

11022 hits

Trackbacks

Trackback specific URI for this entry

No Trackbacks

Comments

Display comments as (Linear | Threaded)

Wow - Heckuva Job testing, Microsoft. Let's just hope there's not a product called 'Null" on the horizon either...

#1 Robert on 2007-11-12 18:25 (Reply)

I found this problem today morning, and I fixed manually with SQL Server Management Studio. I didn't realized that this is a global problem. Good to know.

#2 FlowM@N on 2007-11-12 18:29 (Reply)

The SQL Script mentioned at the WSUS worked fine for me. No more problem! Some poor MSFT WSUS tester is getting raked over the coals tonight!

#3 Robert on 2007-11-12 18:51 (Reply)

Add Comment