RE: RE: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!

I found this mail quite usefull.

Javier Cravioto Pacheco
Programa de las Naciones
Unidas para el Desarrollo
 


> -----Mensaje original-----
> De: [email protected] [mailto:[email protected]] En 
> nombre de Smith, Barry SPAWAR
> Enviado el: Monday, January 27, 2003 1:04 PM
> Para: [email protected]
> Asunto: [GOV-LIST] RE: MS SQL WORM IS DESTROYING INTERNET 
> BLOCK PORT 1434!
> 
> 
> I appreciate your concern, but is this the proper list to be 
> posting this information? I get plenty of email about 
> malicious code and don't need to see it off of this list.
> 
> Thanks,
> Barry
> 
> -----Original Message-----
> From: [email protected] [mailto:[email protected]]
> Sent: Saturday, January 25, 2003 6:41
> To: [email protected]
> Subject: gov-list digest, Vol 1 #36 - 1 msg
> 
> 
> Send gov-list mailing list submissions to
> 	[email protected]
> 
> To subscribe or unsubscribe via the World Wide Web, visit
> 	http://www.ssc.com/mailman/listinfo/gov-list
> or, via email, send a message with subject or body 'help' to
> 	[email protected]
> 
> You can reach the person managing the list at
> 	[email protected]
> 
> When replying, please edit your Subject line so it is more 
> specific than "Re: Contents of gov-list digest..."
> 
> 
> Today's Topics:
> 
>    1. [[email protected]: Re: [linux-elitists] MS SQL WORM 
> IS DESTROYING INTERNET BLOCK PORT 1434!] (Phil Hughes)
> 
> --__--__--
> 
> Message: 1
> Date: Sat, 25 Jan 2003 07:34:57 -0600
> From: Phil Hughes <[email protected]>
> To: [email protected]
> Subject: [GOV-LIST] [[email protected]: Re: 
> [linux-elitists] MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!]
> Reply-To: [email protected]
> 
> This looks like some more good ammunition for the Linux vs. MS cause.
> ----- Forwarded message from "Karsten M. Self" 
> <[email protected]> -----
> 
> Delivered-To: [email protected]
> From: "Karsten M. Self" <[email protected]>
> To: [email protected]
> Subject: Re: [linux-elitists] MS SQL WORM IS DESTROYING 
> INTERNET BLOCK PORT 1434!
> 
> on Sat, Jan 25, 2003 at 02:11:41AM -0500, Michael Bacarella 
> ([email protected]) wrote:
> > I'm getting massive packet loss to various points on the 
> globe. I am 
> > seeing a lot of these in my tcpdump output on each host.
> > 
> > 02:06:31.017088 150.140.142.17.3047 > 
> 24.193.37.212.ms-sql-m:  udp 376 
> > 02:06:31.017244 24.193.37.212 > 150.140.142.17: icmp: 24.193.37.212 
> > udp port ms-sql-m unreachable [tos 0xc0
> > 
> > It looks like there's a worm affecting MS SQL Server which is 
> > pingflooding addresses at some random sequence.
> > 
> > All admins with access to routers should block port 1434 (ms-sql-m)!
> > 
> > Everyone running MS SQL Server shut it the hell down or 
> make sure it 
> > can't access the internet proper!
> > 
> > I make no guarantees that this information is correct, test 
> it out for 
> > yourself!
> 
> Confirmed:
> 
> 
>     CERT advisory
>     http://www.kb.cert.org/vuls/id/370308
> 
>     Traffic impacts
>     http://average.matrix.net/  
> 
> I'm on #debian ATM, this is the topic of some discussion.  
> AU, UK, and DE seem particularly affected.
> 
> Peace.
> 
> -- 
> Karsten M. Self <[email protected]>        
> http://kmself.home.netcom.com/
>  What Part of "Gestalt" don't 
> you understand?
>    Keep software free.         Oppose the CBDTPA.         
> Kill S.2048 dead.
>      http://www.eff.org/alerts/20020322_eff_cbdtpa_alert.html
> 
> ----- End forwarded message -----
> 
> -- 
> Phil Hughes, [email protected]  Phone/FAX: 506-483-1265 
> Aptdo. 89-4060, Alajuela, Costa Rica
> 
> 
> 
> --__--__--
> 
> _______________________________________________
> gov-list mailing list
> [email protected]
> http://www.ssc.com/mailman/listinfo/gov-list
> 
> 
> End of gov-list Digest
> 
> This Linux in Government list is sponsored by Linux Journal.
> 


This Linux in Government list is sponsored by Linux Journal.