[55055] in North American Network Operators' Group
Re: New worm / port 1434?
daemon@ATHENA.MIT.EDU (Lloyd Taylor)
Sat Jan 25 04:32:50 2003
Date: Fri, 24 Jan 2003 23:56:23 -0800 (PST)
From: Lloyd Taylor <ltaylor@keynote.com>
To: Dave Stewart <dbs@dbscom.com>
Cc: nanog@merit.edu
In-Reply-To: <5.1.0.14.2.20030125014934.02ad7f38@gold.dbscom.com>
Errors-To: owner-nanog-outgoing@merit.edu
This may well be the exploit being used:
http://www.nextgenss.com/advisories/mssql-udp.txt
--Lloyd
On Sat, 25 Jan 2003, Dave Stewart wrote:
> Date: Sat, 25 Jan 2003 01:50:03 -0500
> From: Dave Stewart <dbs@dbscom.com>
> To: nanog@merit.edu
> Subject: Re: New worm / port 1434?
>
>
> At 01:32 AM 1/25/2003, you wrote:
>
> >It seems we have a new worm hitting Microsoft SQL server servers on port
> >1434.
>
> Agreed... shutting down MSSQL stopped the flood here.... now to find it and
> remove it
>
