FreeTDS Development Group

[Brian Bruns <camber AT ais.org>]

See the slashdot article for links on this included some 
annontated disassemblies of the worm. FreeTDS doesn't yet implement this 
feature, though it'd probably be worthwhile to.

Brian

On Mon, 27 Jan 2003, [ks_c_5601-1987] ÀÌÁßÈÆ wrote:

> The infamous Slammer worm.
> Although it isn't actually a TDS attack,
> it is related to the MS SQL Server(UDP Port 1434).
> 
> I know that it's a buffer overflow attack, starting with byte 0x04 or 0x08
> or 0x0a.
> I understand that it fakes the packet source as a DNS Server, resulting in
> massive reply packets sent to DNS Servers and crashing them. (Is that
> right?)
> 
> Does anyone here have extra information? An exploit?
> 
> 
> _______________________________________________
> FreeTDS mailing list
> FreeTDS AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/freetds
>