Re: Increased activity on UDP/1434

From: Otto Dandenell <bugtraq(at)fetaste.com>
Date: Sat Jan 25 2003 - 09:36:29 EST

Dmitri Smirnov wrote:

> Having a big number of connections on UDP/1434 from a random

New DDos Worm attacking MSSQL servers through well known buffer overflow vulnerabilities.

Read the Bugtraq thread "MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!".

Make sure your MSSSQL 2000 server is patched with SQL Server Service Pack 3.

Some links:

http://www.kb.cert.org/vuls/id/370308http://www.kb.cert.org/vuls/id/399260http://www.kb.cert.org/vuls/id/484891

Some news: http://news.zdnet.co.uk/story/0,,t269-s2099780,00.html Advisory: http://www.nextgenss.com/advisories/mssql-udp.txt Microsoft Fix:
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/secur ity/bulletin/MS02-039.asp

>From one of the Bugtraq postings:

"Some random screen shots, a copy of the worm as a perl script, and a disassembly (sorry, no comments) can be found online at:

http://www.digitaloffense.net/worms/mssql_udp_worm/ "

Regards

/ Otto Dandenell

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Sun Jan 26 23:08:41 2003