<a href="http://g.adspeed.net/ad.php?do=clk&zid=15220&wd=468&ht=60&pair=as" target="_blank"><img style="border:0px;" src="http://g.adspeed.net/ad.php?do=img&zid=15220&wd=468&ht=60&pair=as" alt="i" width="468" height="60"/></a>
Log in
::
Register
::
Not logged in
Home
Tags
Articles
Editorials
Stairways
Forums
Scripts
Videos
Blogs
QotD
Books
Ask SSC
SQL Jobs
Training
Authors
About us
Contact us
Newsletters
Write for us
<a href="http://g.adspeed.net/ad.php?do=clk&zid=15491&wd=120&ht=300&pair=as" target="_top"><img style="border:0px;" src="http://g.adspeed.net/ad.php?do=img&zid=15491&wd=120&ht=300&pair=as" alt="i" width="120" height="300"/></a>
Recent Posts
Recent Posts
Popular Topics
Popular Topics
Home
Search
Members
Calendar
Who's On
Home
»
Article Discussions
»
Article Discussions by Author
»
Discuss Content Posted by Brian Knight
»
Another SQL Server Virus Hits the Internet
Another SQL Server Virus Hits the Internet
Rate Topic
Display Mode
Topic Options
Author
Message
Brian Knight
Brian Knight
Posted Saturday, January 25, 2003 12:00 AM
SSCommitted
Group: Moderators
Last Login: Monday, August 13, 2012 1:06 PM
Points: 1,928,
Visits: 224
Comments posted to this topic are about the content posted at
http://www.sqlservercentral.com/columnists/bknight/sapphirevirus.asp
Brian Knight
Free SQL Server Training Webinars
Post #9518
Tatsu
Tatsu
Posted Monday, January 27, 2003 10:27 AM
SSC Veteran
Group: General Forum Members
Last Login: Tuesday, May 07, 2013 10:43 AM
Points: 287,
Visits: 213
Some additional comments and corrections (from experience):
the 039 patch is not sufficient to keep a server from becoming infected and, from what I have seen, SP3 does not keep SQLSlammer out either.
Information on how to combat and prevent attacks is available from Microsoft at http://www.microsoft.com/security/slammer.asp
There was a significant amount of confusion due to early incorrect reports from anti-virus suppliers and even Microsoft on how to fix systems.
A stop-gap measure to calm the network down if you are already under attack is to use an AD policy to block UDP port 1434 on all computers. This will prevent further infestation but you will still need to reboot infected servers to get the worm out of memory. Some applications may need ot be configured to use named pipes if you are blocking UDP port 1434 as they will not be able to resolve the port for named instances. Also, this will only work for Windows 2000 and XP environments; NT4/Windows Me do not support AD policies and may still be at risk if running SQL or MSDE 2000.
Bryant E. Byrd, MCDBA
SQL Server DBA/Systems Engineer
Intellithought, Inc.
bbyrd@intellithought.com
Bryant E. Byrd, BSSE MCDBA MCAD
Business Intelligence Administrator
MSBI Administration Blog
Post #52432
K. Brian Kelley
K. Brian Kelley
Posted Monday, January 27, 2003 12:00 PM
Keeper of the Duck
Group: Moderators
Last Login: Wednesday, May 08, 2013 5:14 AM
Points: 6,583,
Visits: 1,787
I'm not following here. The postings I've seen indicate it's using the Buffer Overflow vulnerability found by NGSSoftware and reported in MS02-039. SP3 and the patch from MS02-039 (to include the one available in MS02-061) cover that vulnerability. Are you seeing another attack vector? If so, what else are you seeing is required?
K. Brian Kelley
http://www.truthsolutions.com/
Author: Start to Finish Guide to SQL Server Performance Monitoring
http://www.netimpress.com/shop/product.asp?ProductID=NI-SQL1
K. Brian Kelley, CISA, MCSE, Security+, MVP - SQL Server
Regular Columnist (Security), SQLServerCentral.com
Author of
Introduction to SQL Server: Basic Skills for Any SQL Server User
|
Professional Development blog
|
Technical Blog
|
LinkedIn
|
Twitter
Post #52433
Brian Lockwood
Brian Lockwood
Posted Tuesday, January 28, 2003 8:18 PM
SSC-Enthusiastic
Group: General Forum Members
Last Login: Thursday, October 04, 2007 10:09 AM
Points: 198,
Visits: 2
thx for the article. I have a few basic sql slammer questions ...
1) if you hit the link on sqlservercentral main page for sp3 "SQL Server 2000 Quick Info" you will get http://www.sqlservercentral.com/javen@dbassociates.com.au which produces an error page
2) at http://www.microsoft.com/sql/downloads/2000/sp3.asp I find it kind of confusing as to what exactly is the sp3 download. if you click the link to direct to next page for download there are 3 files at the bottom
"Below are links to the separate files available for this download."
sql2kasp3.exe
SQL2KDeskSP3.exe
sql2ksp3.exe
there is no description for these files. which one exactly should you download?
3) if you go to the slammer link at http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/virus/alerts/slammer.asp it offers you instructions for "recovery" for those already affected.
step 1 is "Set the SQL Server Service to Manual." - can you humor a knucklehead and clarify this? Where can I find this and how do I change it to manual?
4) What would be interesting would be a subjective description of the virus -
is it a query, script file etc?
Is there a way to examine your SQL Server to see if you are infected?
What was the means of infection? It seems having a sql server without sp3 exposed to the internet might be enough.
tia - Brian
Brian Lockwood
LockwoodTech Software
http://www.lockwoodtech.com
Brian Lockwood
President
ApexSQL - SQL Developer Essentials
http://www.apexsql.com/blog
Stand up for an Independent SQL Community - be Informed
Post #52434
K. Brian Kelley
K. Brian Kelley
Posted Tuesday, January 28, 2003 9:04 PM
Keeper of the Duck
Group: Moderators
Last Login: Wednesday, May 08, 2013 5:14 AM
Points: 6,583,
Visits: 1,787
2) at http://www.microsoft.com/sql/downloads/2000/sp3.asp I find it kind of confusing as to what exactly is the sp3 download. if you click the link to direct to next page for download there are 3 files at the bottom
"Below are links to the separate files available for this download."
sql2kasp3.exe
SQL2KDeskSP3.exe
sql2ksp3.exe
there is no description for these files. which one exactly should you download?
sql2kasp3.exe - Analysis Services. Not important for Slammer.
SQL2KDeskSP3.exe - MSDE. If you have MSDE, very important, as MSDE is vulnerable.
SQL2KSP3.exe - Core SQL Server. Important for Slammer.
3) if you go to the slammer link at http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/virus/alerts/slammer.asp it offers you instructions for "recovery" for those already affected.
step 1 is "Set the SQL Server Service to Manual." - can you humor a knucklehead and clarify this? Where can I find this and how do I change it to manual?
If you are on a Win2K Server (Advanced Server, etc.), go to Start | Programs | Administrative Tools | Services. Find MSSQLServer and any that start with MSSQL$. Double click, change start-up to manual.
The worm is in memory only. It doesn't write or change anything permanently. The reason you set it to manual is upon startup you don't get reinfected immediately. It gives you a chance to apply the patch.
4) What would be interesting would be a subjective description of the virus -
is it a query, script file etc?
It is a buffer overflow attack. Specifically, some mean person has crafted a network packet to hit UDP port 1434. It exploits a known SQL 2K vulnerability. The vulnerability allowed the packet to overwrite a portion of active memory. That portion gets overwritten with the worm, who's sole purpose to propogate itself as quickly as possible. It picks out IP addresses psudeo-randomly and fires off the UDP packet. Since UDP is connectionless, it's really a fire and forget, meaning a single worm can generate a ton of traffic and infect unpatched systems extremely fast.
Is there a way to examine your SQL Server to see if you are infected?
If you are infected, you have no bandwidth. It brought down trunks at BellSouth. Internet availability and reachability dropped from greater than 99.99% to 85%.
What was the means of infection? It seems having a sql server without sp3 exposed to the internet might be enough.
A UDP packet destined for port 1434 (SQL Server Listener). SP3 and systems with SP 2 and MS02-039 or MS02-061 are patched. There is a proviso with the SP 2 patches... apparently one of the patches after July undid the MS02-039 patch for the vulnerability (wrong files in the patch). That's why some MS02-061 or MS02-039 systems were infected.
K. Brian Kelley
http://www.truthsolutions.com/
Author: Start to Finish Guide to SQL Server Performance Monitoring
http://www.netimpress.com/shop/product.asp?ProductID=NI-SQL1
Edited by - bkelley on 01/28/2003 10:39:41 PM
K. Brian Kelley, CISA, MCSE, Security+, MVP - SQL Server
Regular Columnist (Security), SQLServerCentral.com
Author of
Introduction to SQL Server: Basic Skills for Any SQL Server User
|
Professional Development blog
|
Technical Blog
|
LinkedIn
|
Twitter
Post #52435
Brian Lockwood
Brian Lockwood
Posted Wednesday, January 29, 2003 5:28 PM
SSC-Enthusiastic
Group: General Forum Members
Last Login: Thursday, October 04, 2007 10:09 AM
Points: 198,
Visits: 2
great reply - thx much for the detailed info
Brian Lockwood
LockwoodTech Software
http://www.lockwoodtech.com
Brian Lockwood
President
ApexSQL - SQL Developer Essentials
http://www.apexsql.com/blog
Stand up for an Independent SQL Community - be Informed
Post #52436
« Prev Topic
|
Next Topic »
Permissions
You
cannot
post new topics.
You
cannot
post topic replies.
You
cannot
post new polls.
You
cannot
post replies to polls.
You
cannot
edit your own topics.
You
cannot
delete your own topics.
You
cannot
edit other topics.
You
cannot
delete other topics.
You
cannot
edit your own posts.
You
cannot
edit other posts.
You
cannot
delete your own posts.
You
cannot
delete other posts.
You
cannot
post events.
You
cannot
edit your own events.
You
cannot
edit other events.
You
cannot
delete your own events.
You
cannot
delete other events.
You
cannot
send private messages.
You
cannot
send emails.
You
may
read topics.
You
cannot
rate topics.
You
cannot
vote within polls.
You
cannot
upload attachments.
You
may
download attachments.
You
cannot
post HTML code.
You
cannot
edit HTML code.
You
cannot
post IFCode.
You
cannot
post JavaScript.
You
cannot
post EmotIcons.
You
cannot
post or upload images.
Copyright © 2002-2013 Simple Talk Publishing. All Rights Reserved.
Privacy Policy.
Terms of Use.
Report Abuse.
