RE: Strange scan on 1433

From: Dias Sgt Kristin F (DiasKF@NOC.USMC.MIL)
Date: 05/21/02


From: Dias Sgt Kristin F <DiasKF@NOC.USMC.MIL>
To: "'Pavel Lozhkin'" <pavel@atrivo.com>, incidents@securityfocus.com
Date: Tue, 21 May 2002 11:23:03 -0400

Vulnerable MS SQL Servers....

This traffic is being seen everywhere for the past 10 hours.....

Microsoft released a security bulletin on April 17 2002 (MS02-020) MS SQL
buffer overflow vulnerability..

 Kristin

-----Original Message-----
From: Pavel Lozhkin [mailto:pavel@atrivo.com]
Sent: Tuesday, May 21, 2002 9:38 AM
To: incidents@securityfocus.com
Subject: Strange scan on 1433

I got a lot of scans today on port 1433 from numerous nets (part of them
are .jp and .kr, but not all)
Does anyone know what they're looking for on the port ?
I've never been scanned on the port before.

-- 
Pavel

---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com

---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com



Relevant Pages

  • Re: Worm1800.exe on UnderNet?
    ... :!Notice!: A Recent Port Scan on your Computer reveals that Port 1800 ... For more information on this free incident handling, management ... and tracking system please see: http://aris.securityfocus.com ...
    (Incidents)
  • RE: possible ssh hack
    ... >> port 4207 ... >> analyzer service. ... >> and tracking system please see: ...
    (Incidents)
  • Re: Port 6635
    ... >We received a very fast scan for port 6635 last night. ... >For more information on this free incident handling, management ... >and tracking system please see: http://aris.securityfocus.com ...
    (Incidents)
  • RE: Increased connects to Port 1433
    ... Increased connects to Port 1433 ... For more information on this free incident handling, management ... and tracking system please see: http://aris.securityfocus.com ...
    (Incidents)
  • RE: Packet from port 80 with spoofed microsoft.com ip
    ... floods the network with broadcast packets on port 80 with spoofed source ... Packet from port 80 with spoofed microsoft.com ip ... For more information on this free incident handling, management ... and tracking system please see: http://aris.securityfocus.com ...
    (Incidents)