When updates are applied to SQL Server software, any software components that have been replaced or made unnecessary must be removed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-79247	SQL6-D0-012700	SV-93953r1_rule		Medium

Description
Previous versions of DBMS components that are not removed from the information system after updates have been installed may be exploited by adversaries. Some DBMSs' installation tools may remove older versions of software automatically from the information system. In other cases, manual review and removal will be required. In planning installations and upgrades, organizations must include steps (automated, manual, or both) to identify and remove the outdated modules. A transition period may be necessary when both the old and the new software are required. This should be taken into account in the planning.

Description

Previous versions of DBMS components that are not removed from the information system after updates have been installed may be exploited by adversaries. Some DBMSs' installation tools may remove older versions of software automatically from the information system. In other cases, manual review and removal will be required. In planning installations and upgrades, organizations must include steps (automated, manual, or both) to identify and remove the outdated modules. A transition period may be necessary when both the old and the new software are required. This should be taken into account in the planning.

STIG	Date
MS SQL Server 2016 Instance Security Technical Implementation Guide	2018-03-09

Details

Check Text ( C-78839r1_chk )
From the server documentation, obtain a listing of required components. Generate a listing of components installed on the server. Click Start >> Type "SQL Server 2016 Installation Center" >> Launch the program >> Click Tools >> Click "Installed SQL Server features discovery report" Compare the feature listing against the required components listing. If any features are installed, but are not required, this is a finding.

Check Text ( C-78839r1_chk )

From the server documentation, obtain a listing of required components.

Generate a listing of components installed on the server.

Click Start >> Type "SQL Server 2016 Installation Center" >> Launch the program >> Click Tools >> Click "Installed SQL Server features discovery report"

Compare the feature listing against the required components listing. If any features are installed, but are not required, this is a finding.

Fix Text (F-85999r1_fix)
Remove all features that are not required.