OT (Bad things afoot on the Internet)

[tberk@mindspring.com (T Berk)]

ternil@union.edu wrote:
> 
> I know some of you guys run Microsoft servers. While I was on shift tonight
> the internet went *thud*, hard. A lot of stuff is still down. Just a heads up
> to you guys who might be running Microsoft SQL server for anything...
> 
> <http://story.news.yahoo.com/news?tmpl=story&u=/ap/20030125/ap_wo_en_po/na_gen_internet_attack_2>
> 
> LT
-------------------------------


It's being called Sapphire;

References:

[1] SQL Sapphire Worm Analysis
<http://www.eeye.com/html/Research/Flash/AL20030125.html>

[2] Buffer Overruns in SQL Server 2000 Resolution Service Could Enable
Code Execution (Q323875)

<http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-039.asp>

[3] Securing SQL Server
<http://www.microsoft.com/sql/techinfo/administration/2000/securingsqlserver.asp>

[4] Unauthenticated Remote Compromise in MS SQL Server 2000
<http://www.nextgenss.com/advisories/mssql-udp.txt>

[5] MS SQL "Sapphire" Worm Mitigation Recommendations
<http://www.cisco.com/warp/public/707/cisco-sn-20030125-worm.shtml>

[6] Impact of Sapphire Worm on Extreme Devices
<http://www.extremenetworks.com/denialNotice.asp>
===========================================================

hth,
TBerk