Re: Increased activity on UDP/1434

From: Justin Bloom <shock(at)shock.ddts.net>
Date: Sat Jan 25 2003 - 09:52:13 EST

Hi,

There is currently a new SQL Server worm doing the rounds on the internet attacking SQL Server 2000 installations and I believe MSDE installs as well. More information is at :-

http://vil.nai.com/vil/content/v_99992.htm

Regards,

Justin

• Original Message ----- From: "Dmitri Smirnov" <Dmitri.Smirnov@fusepoint.com> To: <incidents@securityfocus.com> Sent: Saturday, January 25, 2003 7:05 AM Subject: Increased activity on UDP/1434

Having a big number of connections on UDP/1434 from a random IPs in Internet on
a different networks. One hour ago (22:00 PST) one server in colo space started to initiate
a hundreds of connection per second to diff. hosts on Internet to port UDP/1434 (isolated).
New worms? DDoS? Is anyone experience the same?

Dmitri Smirnov, SSCP
Security Team
Fusepoint Managed Services Inc.
Suite 2323, Three Bentall Centre
595 Burrard Street
P.O. Box 49336
Vancouver B.C. V7X 1L4
Phone: (604) 687-7757
Fax: (604) 687-7761
Email: Dmitri.Smirnov@fusepoint.com

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Sun Jan 26 23:19:14 2003