We've noticed that a new worm which affects ms sql servers is active
on the internet (see NordNOG and NaNOG lists).
We (AS-LAN) blocked one customer, which seems to be infected (outgoing
traffic is up to the line rate).
Anyone also see such problems?
regards,
michel
, January 25, 2003 12:10 PM
Subject: [swinog] New worm / port 1434
We've noticed that a new worm which affects ms sql servers is active
on the internet (see NordNOG and NaNOG lists).
We (AS-LAN) blocked one customer, which seems to be infected (outgoing
traffic is up to the line rate
Good morning,
On Sat, Jan 25, 2003 at 12:10:51PM +0100, Michel Renfer wrote:
We (AS-LAN) blocked one customer, which seems to be infected (outgoing
traffic is up to the line rate).
Anyone also see such problems?
yes, just saw this message on bugtraq:
Subject: [bugtraq] MS SQL WORM IS
On Sat, Jan 25, 2003 at 12:21:46PM +0100, Olivier M. wrote:
Subject: [bugtraq] MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!
http://online.securityfocus.com/archive/1/308306/2003-01-22/2003-01-28/0
there are now a few attacks pro minute:
omega:~ # tcpdump udp port 1434
tcpdump:
We see a lot of this traffic too, and I found quite a few infected
machines at customer sites. Some filters are in place, and our CERT
has been asked to raise this issue with the customers in question.
Seems to be a virus spreading through Microsoft SQL Server's
Monitoring service; possibly
http://internethealthreport.com/
interesting...
--
[EMAIL PROTECTED] Maillist-Archive:
http://www.mail-archive.com/swinog%40swinog.ch/
