Re[2]: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!

From: Stephane - BasicLink (stephane@basiclink.com)
Date: 01/26/03

  • Next message: Matthew Murphy: "Sapphire SQL Worm Analysis Complete" 
    Date: Sat, 25 Jan 2003 16:00:37 -0800
From: Stephane - BasicLink <stephane@basiclink.com>
To: "trent dilkie" <trent@dilkie.com>

    td> Can anybody confirm that this worm is spreading on the Desktop Engine too?
    td> (MSDE)

    td> Thanks,
    td> Trent.

    td> -----Original Message-----
    td> From: H D Moore [mailto:sflist@digitaloffense.net]
    td> Sent: Saturday, January 25, 2003 6:49 AM
    td> To: bugtraq@securityfocus.com
    td> Subject: Re: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!

    <snip>

    Trent,

          Yes we had a Win2K server that got hit and it has never had the
          full version of MSSQL Server on it. MSDE was installed as part
          of MailMax 5 (a mail server) install.

    Stephane

    Saturday, January 25, 2003, 10:56:36 AM, you wrote:

    Relevant Pages

    • Re: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!
      ... And there's no SP3 for MSDE, ... Make sure SQL Server is not running while you copy over the files ... If anyone writes a worm for the Hello bug, I hereby pre-name it the "Yo ... > A worm which exploits a vulnerability in SQL Server is bringing ...
      (Bugtraq)
    • Re: Massive SQL Server attack
      ... Downloading the patch, unplugging the network cable, stopping and starting ... Really, I think all you need to do is install the patch, since you have to ... stop MSDE / SQL to install the patch, at which point the worm disappears.... ...
      (microsoft.public.win2000.security)
    • Stupid MSDE question
      ... Is there anyone who could tell me if MSDE can be accessed by TCP/IP like ... MS-SQL (in the view of the recent worm)? ...
      (Security-Basics)