Re: Re SQL Resolution Service

From: bhagya (bbhagya_at_gmail.com)
Date: 07/29/04

  • Next message: Srini: "RE: IPSec policy between webserver and a clustered db server(SQL20" 
    Date: 28 Jul 2004 15:10:45 -0700

    I am looking for what are the uses of the resolution service which
    runs on UDP 1434 and what commands it takes. I want to look at how did
    the slammer worm succeed in triggering the vulnerability. From my
    search on the Internet it seems that a command can be sent that starts
    with '0x04' followed by some string, which results in opening a
    registry entry on the server. What is the purpose of this command? Is
    it for creating new named intances? If so, why would you allow anybody
    to create new named instance on the server without any authentication?
    any thoughts or ideas?

    Thanks,
    Bhagya

    Sue Hoegemeier <Sue_H@nomail.please> wrote in message news:<tg4fg0tm3lodstc7d5cllmj6g5guhh21pt@4ax.com>...
    > SQL Resolution Service on UDP 1434 is only used to support
    > multi-instances. It's not used with SQL Server 7 as that
    > version doesn't support named instances. It's not used by
    > the SQL Server instance or directly by clients to connect to
    > SQL Server. It's just to enumerate the instances on a server
    > and find the listening port for the specific instance.
    > If you try to connect to YourServer\YourNamedInstance and
    > that's what you specify for the connection, it hits UDP 1434
    > to use the SQL Server Resolution Service to find what port
    > number YourServer\YourNamedInstance is listening on. You can
    > bypass that by specifying the port yourself and then there
    > is no need to go through UDP 1434.
    >
    > -Sue
    >
    > On Wed, 28 Jul 2004 01:08:02 -0700, SqlJunkies User
    > <User@-NOSPAM-SqlJunkies.com> wrote:
    >
    > >Hi,
    > >
    > >I am a novice to SQL Server. I work in the area of network
    security. In my study of the SQL Slammer/Sapphire worm, I came across
    SQL Resolution Service which listens on UDP Port 1434. It seems that
    this service is used by clients to get the list of named instances, to
    exchange keep-alive messages, and for opening a registry key (the
    slammer worm cause). I would like to know what are its other uses and
    other acceptable commands by the service. After my futile search on
    MSDN I am posting a message here.
    > >
    > >Any pointers or links regarding this are more than welcome.
    > >
    > >Thanks in advance,
    > >Bhagya
    > >
    > >---
    > >Posted using Wimdows.net NntpNews Component -
    > >
    > >Post Made from http://www.SqlJunkies.com/newsgroups Our newsgroup engine supports Post Alerts, Ratings, and Searching.

  • Next message: Srini: "RE: IPSec policy between webserver and a clustered db server(SQL20"

    Relevant Pages

    • Re: Re SQL Resolution Service
      ... SQL Resolution Service on UDP 1434 is only used to support ... version doesn't support named instances. ... the SQL Server instance or directly by clients to connect to ...
      (microsoft.public.sqlserver.security)
    • Microsoft Security Bulletin MS02-039: Buffer Overruns in SQL Server 2000 Resolution Service Could En
      ... Buffer Overruns in SQL Server 2000 Resolution Service ... There are three security vulnerabilities here. ... The third vulnerability is a denial of service vulnerability. ...
      (Bugtraq)
    • Alert: Microsoft Security Bulletin - MS02-039
      ... Buffer Overruns in SQL Server 2000 Resolution Service Could Enable Code Execution ... Impact of vulnerability: Three vulnerabilities, the most serious of which could enable an attacker to gain control over an affected SQL Server 2000 installation. ... Buffer Overruns in SQL Server Resolution Service: ...
      (NT-Bugtraq)
    • Re: Data Source = problem
      ... Looks like name resolution service goes off spontaneously. ... quite safe to do what you already suggested - use IP address for Data ... Nothing seems to specifically trigger it. ... > connects to SQL Server worked, but none of the other ones would. ...
      (microsoft.public.inetserver.asp.general)
    • Re: Why does sql 2000 scream to the world ... how do you shut this thing up?
      ... SQL Server 7 is not affected by the slammer worm. ... Resolution Service which is used by SQL Server 2000 to ... that's just life on the internet I'm afraid. ...
      (microsoft.public.sqlserver.security)