New SQL Worm Spreading Rapidly

[browolf]

Internet Security systems Security Alert
January 25, 2003

Microsoft SQL Slammer Worm Propagation

Synopsis:
ISS X-Force has learned of a worm that is spreading via Microsoft SQL
servers. The worm is responsible for large amounts of Internet traffic as
well as millions of UDP/IP probes at the time of this alert's publication.
This worm attempts to exploit MS/SQL servers vulnerable to the SQL Server
Resolution service buffer overflow (CVE CAN-2002-0649). Once a vulnerable
computer is compromised, the worm will infect that target, randomly select a
new target, and resend the exploit and propagation code to that host.


ISS X-Force recommends blocking UDP port 1433 and 1434 traffic to protect SQL Server databases with a firewall or packet filter.

more info:

http://bvlive01.iss.net/issEn/delivery/xforce/alertdetail.jsp?oid=21824

===============
Security Forums

http://www.security-forums.com

 

[browolf]

also

“It is so good at replicating that it generates massive amounts of traffic that will slow down networks,” Hypponen said. “The end user never sees it. They only experience the slowdown on the Net.”

Security experts blamed the worm for crashing almost all Internet services in South Korea.

from:

http://news.com.com/2100-1001-982131.html

===============
Security Forums

http://www.security-forums.com