freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

[freetds] MS-SQL Slammer Worm

From: 이중훈 <wanja AT inzen.com>
To: <freetds AT lists.ibiblio.org>
Subject: [freetds] MS-SQL Slammer Worm
Date: Mon, 27 Jan 2003 11:53:59 +0900

The infamous Slammer worm.
Although it isn't actually a TDS attack,
it is related to the MS SQL Server(UDP Port 1434).

I know that it's a buffer overflow attack, starting with byte 0x04 or 0x08
or 0x0a.
I understand that it fakes the packet source as a DNS Server, resulting in
massive reply packets sent to DNS Servers and crashing them. (Is that
right?)

Does anyone here have extra information? An exploit?

[freetds] [PATCH] make replacements more configurable, Craig A. Berry, 01/26/2003
- [freetds] MS-SQL Slammer Worm, 이중훈, 01/26/2003
  - Re: [freetds] MS-SQL Slammer Worm, Brian Bruns, 01/27/2003
    - RE: [freetds] MS-SQL Slammer Worm, Daniel Morgan, 01/27/2003
      - RE: [freetds] MS-SQL Slammer Worm, Frediano Ziglio, 01/27/2003
- <Possible follow-up(s)>
- RE: [freetds] [PATCH] make replacements more configurable, Castellano, Nicholas, 01/27/2003
  - RE: [freetds] [PATCH] make replacements more configurable, Craig A. Berry, 01/27/2003
- RE: [freetds] [PATCH] make replacements more configurable, Lowden, James K, 01/27/2003
  - RE: [freetds] [PATCH] make replacements more configurable, Craig A. Berry, 01/28/2003
    - Re: [freetds] [PATCH] make replacements more configurable, Craig Davison, 01/28/2003
      - Re: [freetds] [PATCH] make replacements more configurable, Craig A. Berry, 01/29/2003
- RE: [freetds] [PATCH] make replacements more configurable, Lowden, James K, 01/28/2003