Dmitri Smirnov wrote: > Having a big number of connections on UDP/1434 from a random > IPs in Internet on a different networks. One hour ago (22:00 > PST) one server in colo space started to initiate a hundreds > of connection per second to diff. hosts on Internet to port > UDP/1434 (isolated). New worms? DDoS? Is anyone experience the same? New DDos Worm attacking MSSQL servers through well known buffer overflow vulnerabilities. Read the Bugtraq thread "MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!". Make sure your MSSSQL 2000 server is patched with SQL Server Service Pack 3. Some links: http://www.kb.cert.org/vuls/id/370308 http://www.kb.cert.org/vuls/id/399260 http://www.kb.cert.org/vuls/id/484891 Some news: http://news.zdnet.co.uk/story/0,,t269-s2099780,00.html Advisory: http://www.nextgenss.com/advisories/mssql-udp.txt Microsoft Fix: http://www.microsoft.com/technet/treeview/default.asp?url=/technet/secur ity/bulletin/MS02-039.asp From one of the Bugtraq postings: "Some random screen shots, a copy of the worm as a perl script, and a disassembly (sorry, no comments) can be found online at: http://www.digitaloffense.net/worms/mssql_udp_worm/ " Regards / Otto Dandenell ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Sun Jan 26 2003 - 20:00:40 PST