Re: URGENT: New SQL Worm?

From: Russ (Russ.Cooper@RC.ON.CA)
Date: 01/25/03

  • Next message: Russ: "W32/SQLSlammer" 
    Date:         Sat, 25 Jan 2003 06:47:17 -0500
From: Russ <Russ.Cooper@RC.ON.CA>
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

    Here's what TruSecure has gathered so far;

    1. SQL Server 2000 and Microsoft SQL Desktop Engine (MSDE) 2000 are
    affected

    2. MS02-039 patches the vulnerability this new worm is attacking. This
    fix is also included in SQL Server SP3.

    3. Anyone who took the appropriate actions to protect against SQL-Spida
    is protected against this worm. Those actions included;

    a) Blocking inbound access to UDP1434, the SQL Server 2000 Resolution
    Service port. This port is similar to the RPC End Point Mapper port
    (TCP135) which redirects client requests for a server service to a
    dynamically allocated port.

    b) Patching

    4. The biggest effect so far appears to be the amount of traffic
    generated. Some reports indicate as much as 500Mbps of traffic caused by
    this worm. No reports of the compromised systems being damaged have been
    sent (so far). Overall Internet Latency was seriously affected
    overnight, but it appears to be recovering;

    http://average.miq.net/

    5. Microsoft, the White House, the FBI, and CERT have all been notified;

    http://story.news.yahoo.com/news?tmpl=story&u=/ap/20030125/ap_wo_en_po/n
    a_gen_internet_attack_2

    6. I personally have received over 10,000 attacks between midnight
    (eastern) and 6:00am.

    Cheers,
    Russ - Surgeon General of TruSecure Corporation/NTBugtraq Editor

    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
    Delivery co-sponsored by TruSecure Corporation
    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
    TICSA - Anniversary Special - Limited Time

    Become TICSA certified for just $221.25 US when you register before 3/31/03
    with PROMO "TS0103" at www.2test.com. NO membership fees, certification
    good for 2 years. Price for international delivery just $296.25 US, with
    this offer. Offer cannot be combined with any other special and expires
    3/31/03. Visit www.trusecure.com/ticsa for full details.

    oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo

    Relevant Pages

    • Re: Massive SQL Server attack
      ... MS02-039 patches the vulnerability this new worm is attacking. ... Blocking inbound access to UDP1434, the SQL Server 2000 Resolution ... Service port. ...
      (microsoft.public.win2000.security)
    • Re: MSQL Server and Slammer
      ... will try to connect to Port 1434 UDP to transfer the worm to you again. ... > I updated "Sql server Windows NT" running on a computer with XP Pro with ... > In my case the SQL-server has nothing to do on the internet. ...
      (microsoft.public.sqlserver.security)
    • RE: [Full-Disclosure] RE: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!
      ... > BLOCK PORT 1434! ... >>> Until you've walked a mile in the shoes of the admins having to deal ... > a normal port for SQL server *until* MSDE came out. ... mod_ssl worm that reminded everyone to patch ...
      (Full-Disclosure)
    • Re: SQL Worm
      ... >will allow a connection to port 1433. ... I'm guessing that the worm has been modified and ... >other hosts on the net that had SQL Server on port 1433 with an empty ... >password on the SA account. ...
      (microsoft.public.sqlserver.security)
    • Re: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!
      ... And there's no SP3 for MSDE, ... Make sure SQL Server is not running while you copy over the files ... If anyone writes a worm for the Hello bug, I hereby pre-name it the "Yo ... > A worm which exploits a vulnerability in SQL Server is bringing ...
      (Bugtraq)