RE: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!

I appreciate your concern, but is this the proper list to be posting this information? I get plenty of email about malicious code and don't need to see it off of this list.

Thanks,
Barry

-----Original Message-----
From: [email protected] [mailto:[email protected]]
Sent: Saturday, January 25, 2003 6:41
To: [email protected]
Subject: gov-list digest, Vol 1 #36 - 1 msg


Send gov-list mailing list submissions to
	[email protected]

To subscribe or unsubscribe via the World Wide Web, visit
	http://www.ssc.com/mailman/listinfo/gov-list
or, via email, send a message with subject or body 'help' to
	[email protected]

You can reach the person managing the list at
	[email protected]

When replying, please edit your Subject line so it is more specific
than "Re: Contents of gov-list digest..."


Today's Topics:

   1. [[email protected]: Re: [linux-elitists] MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!] (Phil Hughes)

--__--__--

Message: 1
Date: Sat, 25 Jan 2003 07:34:57 -0600
From: Phil Hughes <[email protected]>
To: [email protected]
Subject: [GOV-LIST] [[email protected]: Re: [linux-elitists] MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!]
Reply-To: [email protected]

This looks like some more good ammunition for the Linux vs. MS cause.
----- Forwarded message from "Karsten M. Self" <[email protected]> -----

Delivered-To: [email protected]
From: "Karsten M. Self" <[email protected]>
To: [email protected]
Subject: Re: [linux-elitists] MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!

on Sat, Jan 25, 2003 at 02:11:41AM -0500, Michael Bacarella ([email protected]) wrote:
> I'm getting massive packet loss to various points on the globe.
> I am seeing a lot of these in my tcpdump output on each
> host.
> 
> 02:06:31.017088 150.140.142.17.3047 > 24.193.37.212.ms-sql-m:  udp 376
> 02:06:31.017244 24.193.37.212 > 150.140.142.17: icmp: 24.193.37.212 udp port ms-sql-m unreachable [tos 0xc0
> 
> It looks like there's a worm affecting MS SQL Server which is
> pingflooding addresses at some random sequence.
> 
> All admins with access to routers should block port 1434 (ms-sql-m)!
> 
> Everyone running MS SQL Server shut it the hell down or make
> sure it can't access the internet proper!
> 
> I make no guarantees that this information is correct, test it
> out for yourself!

Confirmed:


    CERT advisory
    http://www.kb.cert.org/vuls/id/370308

    Traffic impacts
    http://average.matrix.net/  

I'm on #debian ATM, this is the topic of some discussion.  AU, UK, and
DE seem particularly affected.

Peace.

-- 
Karsten M. Self <[email protected]>        http://kmself.home.netcom.com/
 What Part of "Gestalt" don't you understand?
   Keep software free.         Oppose the CBDTPA.         Kill S.2048 dead.
     http://www.eff.org/alerts/20020322_eff_cbdtpa_alert.html

----- End forwarded message -----

-- 
Phil Hughes, [email protected]  Phone/FAX: 506-483-1265 
Aptdo. 89-4060, Alajuela, Costa Rica



--__--__--

_______________________________________________
gov-list mailing list
[email protected]
http://www.ssc.com/mailman/listinfo/gov-list


End of gov-list Digest

This Linux in Government list is sponsored by Linux Journal.