[freetds] MS-SQL Slammer Worm

이중훈 wanja at inzen.com
Mon Jan 27 11:53:59 EST 2003


The infamous Slammer worm.
Although it isn't actually a TDS attack,
it is related to the MS SQL Server(UDP Port 1434).

I know that it's a buffer overflow attack, starting with byte 0x04 or 0x08
or 0x0a.
I understand that it fakes the packet source as a DNS Server, resulting in
massive reply packets sent to DNS Servers and crashing them. (Is that
right?)

Does anyone here have extra information? An exploit?





More information about the FreeTDS mailing list