Signature Detail

WORM: SQLSlammer Worm Infection Attempt

This signature detects attempts by the Sapphire worm to create a distributed denial of service (DDoS) against Microsoft SQL Servers. The Sapphire worm, also called the Slammer worm, uses outbound packets on UDP/1434 to scan for vulnerable SQL servers and loads instructions into the memory of any compromised server. The worm then continues to scan for vulnerable SQL servers using outbound UDP packets, causing a DDoS.

Extended Description

A vulnerability has been discovered in Microsoft SQL Server 2000 that could make it possible for remote attackers to gain access to target hosts. A problem in the SQL Server Resolution Service makes it possible for a remote user to execute arbitrary code on a vulnerable host. An attacker could exploit a stack-based overflow in the resolution service by sending a maliciously crafted UDP packet to port 1434. It has been reported that a vulnerable version of MSDE 2000 is automatically installed with Internet Explorer 6 on .NET servers. ***UPDATE: A worm that may exploit this vulnerability has been detected in the wild. Administrators are advised to block all external access to database servers until more information is available. Access to TCP and UDP ports 1434 should be denied completely. Additionally, implementing filter rules for other ports may also decrease the chances of compromise through yet unknown avenues. This should be done even if the patch for this particular vulnerability has been installed. Cisco has released an advisory that details workaround information. Microsoft recommends that affected users apply SQL Server 2000 Service Pack 3. BlackBoard 5.5.1 Level 3 users can apply SQL Server 2000 Service Pack 3. Users are advised to contact BlackBoard for further information.

Affected Products

• Microsoft data_engine_2000
• Microsoft sql_server_2000 SP1
• Microsoft sql_server_2000 SP2
• Microsoft sql_server_2000
• Microsoft sql_server_2000_desktop_engine
• Veritas_software backup_exec_for_windows_servers 9.0.0

References

• BugTraq: 5311
• CVE: CVE-2002-0649
• URL: http://www.microsoft.com/technet/security/bulletin/ms02-039.asp
• URL: http://www.kb.cert.org/vuls/id/484891