Chris
------ Forwarded Message
From: "Technical Support" <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
Date: Sat, 25 Jan 2003 11:36:53 -0600
To: <[EMAIL PROTECTED]>
Subject: [ORBIT-ANNOUNCEMENT] Internet Traffic and SQL 2000 Alert!!
At approximately 11:28pm on 1/24/2003, NOC engineers observed significant inbound and outbound traffic across all backbone carriers and internal router/switching infrastructure. Our emergency network response team was immediately deployed and began troubleshooting the problem. Upon the first notification to our carriers, we were informed of a global internet problem by a fast spreading SQL worm targeted at Microsoft SQL. As a result, the entire internet continues to suffer from an extreme decrease in service. Please see the following links for international coverage of the breaking story.
http://www.cnn.com/2003/TECH/internet/01/25/internet.attack.ap/index.html <http://www.cnn.com/2003/TECH/internet/01/25/internet.attack.ap/index.html>
http://abcnews.go.com/wire/Politics/ap20030125_309.html <http://abcnews.go.com/wire/Politics/ap20030125_309.html>
http://story.news.yahoo.com/news?tmpl=story&u=/ap/20030125/ap_wo_en_po/na_gen_internet_attack_2 <http://story.news.yahoo.com/news?tmpl=story&u=/ap/20030125/ap_wo_en_po/na_gen_internet_attack_2>
http://securityresponse.symantec.com/avcenter/venc/data/w32.sqlexp.worm.html <http://securityresponse.symantec.com/avcenter/venc/data/w32.sqlexp.worm.html>
http://www.msnbc.com/news/864184.asp?0cm=c10 <http://www.msnbc.com/news/864184.asp?0cm=c10>
The Planet is working continuously detecting, locating, and removing all infected SQL servers from our network along with blocking all inbound traffic directed to the specific SQL ports under attack. As we continue to assist those customers affected, The Planet seeks to inform all customers of this global rising problem and to assure you that service is available to the maximum extent possible. Planet engineers are working with Microsoft and Cisco to apply all patches available along with all protective measures as they will be released in the next few hours/days/weeks. The Planet is dedicated to ensuring maximum uptime and all NOC staff and network engineers will remain onsite under Level 1 alert until all network connectivity returns to normal. We appreciate your patience in this matter.
If you have a Microsoft SQL product in our datacenters, please contact our NOC staff via Orbit ticket, email or phone for further assistance.
https://orbit.theplanet.com/ <https://orbit.theplanet.com%22>
[EMAIL PROTECTED]
1.800.854.7679
Several Security companies have released the following information in reference to this problem.
http://securityresponse.symantec.com/avcenter/venc/data/w32.sqlexp.worm.html <http://securityresponse.symantec.com/avcenter/venc/data/w32.sqlexp.worm.html>
http://www.eeye.com/html/Research/Flash/AL20030125.html <http://www.eeye.com/html/Research/Flash/AL20030125.html>
http://www.cert.org/advisories/CA-2003-04.html <http://www.cert.org/advisories/CA-2003-04.html>
Service pack 3 is available for SQL 2000 at the following.
http://www.microsoft.com/downloads/details.aspx?FamilyId=9032F608-160A-4537-A2B6-4CB265B80766&displaylang=en <http://www.microsoft.com/downloads/details.aspx?FamilyId=9032F608-160A-4537-A2B6-4CB265B80766&displaylang=en>
Stand alone patch for SQL 2000
http://www.microsoft.com/technet/treeview/default.asp?url="" SIZE="1"> <http://www.microsoft.com/technet/treeview/default.asp?url=""
The Planet will continue to release news updates and we receive information from Microsoft and our backbone providers.
---------------
You have recieved this message because you are a valued customer of The Planet Internet Services, Inc. The contents of this message pertain to the services that we provide to you. If you do not wish to receive these messages in the future, or if you would like to add other members of your organization to this list, please contact our Technical Support department.
---------------
The Planet Internet Services, Inc Technical Support
[EMAIL PROTECTED]
214.782.7800 800.854.7679
1333 Stemmons Frwy., Suite 110
Dallas, Texas 75207
---------------
------ End of Forwarded Message
