FreeTDS Development Group

["Daniel Morgan" <danmorg AT sc.rr.com>]

It causes a Denial Of Service. It happened to me running MS SQL 2000 on
Windows XP Pro.
The suggestion by Microsoft was to install the security fix that has been
out for six months.

I actually thought it was my ISP having problems at first; however, I knew
something was up whenever I rebooted, I had internet for a few minutes.
Then I came across slashdot.org's article.

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/
virus/alerts/slammer.asp

That is one link above.  Outlook has the tendency to word wrap URLs for some
stupid reason.

Two choices:
1. Install the fix (MS02-061)
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/
bulletin/MS02-061.asp

2. Install MS SQL Server 2000 Service Pack 3
http://www.microsoft.com/sql/downloads/2000/sp3.asp

Here is the Slashdot article
http://slashdot.org/articles/03/01/25/2123244.shtml?tid=95

-----Original Message-----
From: freetds-admin AT lists.ibiblio.org
[mailto:freetds-admin AT lists.ibiblio.org]On Behalf Of Brian Bruns
Sent: Monday, January 27, 2003 6:15 AM
To: freetds AT lists.ibiblio.org
Subject: Re: [freetds] MS-SQL Slammer Worm


See the slashdot article for links on this included some
annontated disassemblies of the worm. FreeTDS doesn't yet implement this
feature, though it'd probably be worthwhile to.

Brian

On Mon, 27 Jan 2003, [ks_c_5601-1987] ÀÌÁßÈÆ wrote:

> The infamous Slammer worm.
> Although it isn't actually a TDS attack,
> it is related to the MS SQL Server(UDP Port 1434).
>
> I know that it's a buffer overflow attack, starting with byte 0x04 or 0x08
> or 0x0a.
> I understand that it fakes the packet source as a DNS Server, resulting in
> massive reply packets sent to DNS Servers and crashing them. (Is that
> right?)
>
> Does anyone here have extra information? An exploit?