Slashdot Mirror

← Back to Stories (view on slashdot.org)

MS SQL Server Worm Wreaking Havoc

Posted by ryuzaki0 on from the no-man-will-know-the-day-or-the-hour dept.

defile writes "Since about midnight EST almost every host on the internet has been receiving a 376 byte UDP payload on port ms-sql-m (1434) from a random infected server. Reports of some hosts receiving 10 per minute or more. internetpulse.net is reporting UUNet and Internap are being hit very hard. This is the cause of major connectivity problems being experienced worldwide. It is believed this worm leverages a vulnerability published in June 2002. Several core routers have taken to blocking port 1434 outright. If you run Microsoft SQL Server, make sure the public internet can't access it. If you manage a gateway, consider dropping UDP packets sent to port 1434." bani adds "This has effectively disabled 5 of the 13 root nameservers."

4 of 906 comments (clear)

  1. Re:US Military Intelligence? by ecalkin · · Score: 0, Offtopic

    If it hadn't been for a last minute scud that hit a barracks and killed a bunch of US servicemen, the united states would have killed more of its own soldiers than iraq did. friendly fire may be an oxymoron, but it happens...

  2. the time has come. by seann · · Score: 0, Offtopic

    all you rebel programmers, join together in a glory of defeat and dishonourment.
    We will create an Anti-worm! It will counter these attacks, patching, disabling, and even illiminating!

    Band together now!!!!!!!!

    --
    I'm a big retard who forgot to log out of Slashdot on Mike's computer! LOOK AT ME.
  3. Re:Who did this I wonder????? by Ilgaz · · Score: 0, Offtopic

    Man/Woman, whoever you are... Now that was genius work, I have never seen such a thing in my life.

    btw, feel free to "offtopic" me and waste my karma, I give my karma to that!

  4. MSCE = Microsoft Certifed Solitaire Engineer by Wolfgang · · Score: 0, Offtopic

    Or what else does it mean?