Re: [Full-Disclosure] The worm author finally revealed!

From: David Howe (DaveHowe@cmn.sharp-uk.co.uk)
Date: 02/03/03

  • Next message: Georgi Guninski: "[Full-Disclosure] Re: David Litchfield talks about the SQL Worm in the Washington Post" 
    From: "David Howe" <DaveHowe@cmn.sharp-uk.co.uk>
To: "Email List: Full Disclosure" <full-disclosure@lists.netsys.com>
Date: Mon, 3 Feb 2003 12:14:40 -0000

    at Friday, January 31, 2003 7:52 PM, madsaxon <madsaxon@direcway.com>
    was seen to say:
    > That happens where I work, too. Every new patch breaks something
    > else, and since a fair amount of our software is custom-designed, we
    > have to get the vendors to rush out and figure out how to patch their
    > stuff to be compatible with the new patch. That costs beaucoup
    > bucks, and meanwhile our clients are screaming because their
    > application is down. The next time a patch comes out, management is
    > very reluctant to allow us to install it, so we have to do a
    > cost-benefit analysis on which would be the greater evil: leaving the
    > vulnerability unpatched or pissing off our clients with yet another
    > period of downtime. If we don't patch, we get called "irresponsible"
    > and "lazy."
    Certainly true. then you have the wonderful microsoft habit of a later
    patch overwriting (and therefore silently backing out) an earlier
    patch's files, and the fact that some sites *legally can't* install the
    more recent service packs/patches as microsofts new licencing agreement
    conflicts with a legal duty of privacy for the data processed on that
    machine.

    > I personally argued strongly against Microsoft servers in the first
    > place, but of course that was pooh-poohed as just sour grapes from an
    > old Unix fossil.
    Unfortunately, its a cascade - new features of IE require windows
    servers, which require users to be using IE.....

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

    Relevant Pages

    • Re: Critical Alert Update - W32.Slammer
      ... The .net SDK 1.0 sp1 comes with a very basic SQL Server engine for testing ... >> Microsoft SQL Desktop ... >>>cumulative SQL security patch, is completely safe from ... >> may install SQL ...
      (microsoft.public.security)
    • Critical Alert Update - W32.Slammer
      ... It's not clear if SQL Server 2000 SP1/SP2 includes the ... Microsoft SQL Desktop ... and all applications that install ... >most recent cumulative SQL Server security patch, ...
      (microsoft.public.security)
    • Re: Problems installing critical update
      ... this patch (Security Update for Microsoft XML Core Services 4.0 for Service ... the message is still there when I reboot. ... Microsoft Update to require me to install both KB936181 and KB933579. ...
      (microsoft.public.windowsupdate)
    • Re: Microsoft notice on W32.Slammer
      ... >PSS Security Response Team Alert - New Worm: ... >1434 utilizing a vulnerability that was patched in Microsoft Security ... > Microsoft, however, recommends that customers install the most recent ... >cumulative security patch for Microsoft SQL Server 2000 which is Microsoft ...
      (microsoft.public.sqlserver.security)
    • Re: Shame on Microsoft
      ... Download the patch and remind the user to install. ... every Start Menu since, when, Windows 98? ... Microsoft can't be blamed for ...
      (microsoft.public.security)