2003WormVulnerability exploitation
SQL Slammer worm
25 January 2003
SQL Slammer, also called Sapphire, was a tiny worm that fitted in a single UDP packet and exploited a buffer overflow in Microsoft SQL Server's resolution service, patched six months earlier in MS02-039. Because it needed no connection set-up, it spread faster than any worm before it and congested networks around the world.
- Victim
- Systems running Microsoft SQL Server 2000 or MSDE 2000
- Sector
- Cross-sector
- Public attribution
- Not publicly attributed; this page makes no attribution.
Impact
CAIDA found it infected at least 75,000 hosts, doubled in size about every 8.5 seconds, and reached more than 90 percent of vulnerable hosts within 10 minutes.
Root cause
Database services exposed to the internet on UDP 1434 and left unpatched, including in desktop products that embedded the database engine.
Lessons learned: the controls it teaches
- Never expose database services directly to the internet; filter ports at the perimeter.
- Inventory embedded components so you know which products need a patch.
- Patch management must include servers and software that bundle third-party engines.