Re: URGENT: New SQL Worm?

From: Russ (Russ.Cooper@RC.ON.CA)
Date: 01/25/03

  • Next message: Russ: "W32/SQLSlammer"
    Date:         Sat, 25 Jan 2003 06:47:17 -0500
    From: Russ <Russ.Cooper@RC.ON.CA>

    Here's what TruSecure has gathered so far;

    1. SQL Server 2000 and Microsoft SQL Desktop Engine (MSDE) 2000 are

    2. MS02-039 patches the vulnerability this new worm is attacking. This
    fix is also included in SQL Server SP3.

    3. Anyone who took the appropriate actions to protect against SQL-Spida
    is protected against this worm. Those actions included;

    a) Blocking inbound access to UDP1434, the SQL Server 2000 Resolution
    Service port. This port is similar to the RPC End Point Mapper port
    (TCP135) which redirects client requests for a server service to a
    dynamically allocated port.

    b) Patching

    4. The biggest effect so far appears to be the amount of traffic
    generated. Some reports indicate as much as 500Mbps of traffic caused by
    this worm. No reports of the compromised systems being damaged have been
    sent (so far). Overall Internet Latency was seriously affected
    overnight, but it appears to be recovering;

    5. Microsoft, the White House, the FBI, and CERT have all been notified;

    6. I personally have received over 10,000 attacks between midnight
    (eastern) and 6:00am.

    Russ - Surgeon General of TruSecure Corporation/NTBugtraq Editor

    Delivery co-sponsored by TruSecure Corporation
    TICSA - Anniversary Special - Limited Time

    Become TICSA certified for just $221.25 US when you register before 3/31/03
    with PROMO "TS0103" at NO membership fees, certification
    good for 2 years. Price for international delivery just $296.25 US, with
    this offer. Offer cannot be combined with any other special and expires
    3/31/03. Visit for full details.