Here's what TruSecure has gathered so far;

1. SQL Server 2000 and Microsoft SQL Desktop Engine (MSDE) 2000 are
affected

2. MS02-039 patches the vulnerability this new worm is attacking. This
fix is also included in SQL Server SP3.

3. Anyone who took the appropriate actions to protect against SQL-Spida
is protected against this worm. Those actions included;

a) Blocking inbound access to UDP1434, the SQL Server 2000 Resolution
Service port. This port is similar to the RPC End Point Mapper port
(TCP135) which redirects client requests for a server service to a
dynamically allocated port.

b) Patching

4. The biggest effect so far appears to be the amount of traffic
generated. Some reports indicate as much as 500Mbps of traffic caused by
this worm. No reports of the compromised systems being damaged have been
sent (so far). Overall Internet Latency was seriously affected
overnight, but it appears to be recovering;

http://average.miq.net/

5. Microsoft, the White House, the FBI, and CERT have all been notified;

http://story.news.yahoo.com/news?tmpl=story&u=/ap/20030125/ap_wo_en_po/n
a_gen_internet_attack_2

6. I personally have received over 10,000 attacks between midnight
(eastern) and 6:00am.

Cheers,
Russ - Surgeon General of TruSecure Corporation/NTBugtraq Editor

oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
Delivery co-sponsored by TruSecure Corporation
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
TICSA - Anniversary Special - Limited Time

Become TICSA certified for just $221.25 US when you register before 3/31/03
with PROMO "TS0103" at www.2test.com. NO membership fees, certification
good for 2 years. Price for international delivery just $296.25 US, with
this offer. Offer cannot be combined with any other special and expires
3/31/03. Visit www.trusecure.com/ticsa for full details.

oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]