[ale] [Fwd: RE: MS SQL WORM and PORT 1434!]

[Geoffrey]

I'm seeing this as well at my firewall, denied of course. :)

Anyone else seeing it?  Anyone have any info on it?  21 hits against my 
box yesterday alone.  None yet today though.

-------- Original Message --------
Subject: RE: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!
Date: Sat, 25 Jan 2003 19:59:12 +1100
From: Jeff Mills <Jeff.Mills at pocold.com.au>
To: ale at ale.org
To: bugtraq at securityfocus.com


> I'm getting massive packet loss to various points on the globe.
> I am seeing a lot of these in my tcpdump output on each
> host.
> 
> 02:06:31.017088 150.140.142.17.3047 > 24.193.37.212.ms-sql-m:  udp 376
> 02:06:31.017244 24.193.37.212 > 150.140.142.17: icmp: 
> 24.193.37.212 udp port ms-sql-m unreachable [tos 0xc0
> 
> It looks like there's a worm affecting MS SQL Server which is
> pingflooding addresses at some random sequence.

It seems you're right.
My firewall is taking alot of hits on port 1434 since about 4pm Australian
Eastern Daylight Saving Time:

Jan 25 16:30:31 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
eth870.sa.adsl.internode.on.net:1310 (376 data bytes)
Jan 25 16:32:35 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
dev1.cinemas.ch:1683 (376 data bytes)
Jan 25 16:34:21 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
216.179.192.248:4161 (376 data bytes)
Jan 25 16:34:41 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
sql.webcoretech.com:3113 (376 data bytes)
Jan 25 16:34:42 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
hds-connected.hds.com:3967 (376 data bytes)
Jan 25 16:35:34 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
216.95.164.23:1141 (376 data bytes)
Jan 25 16:35:56 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
134.210.1.226:3975 (376 data bytes)
Jan 25 16:36:54 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
211.104.36.123:2550 (376 data bytes)
Jan 25 16:38:30 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
cts21612069172.cts.com:1031 (376 data bytes)
Jan 25 16:38:31 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
216.109.150.210:3462 (376 data bytes)
Jan 25 16:39:02 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
207.102.74.40:4605 (376 data bytes)
Jan 25 16:39:05 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
66.189.0.11:4198 (376 data bytes)
Jan 25 16:39:20 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
dnsup1.biz.rr.com:3915 (376 data bytes)
Jan 25 16:39:50 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
211.139.140.18:3623 (376 data bytes)
Jan 25 16:40:24 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
210.91.85.200:1113 (376 data bytes)
Jan 25 16:40:26 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
criminal.justice.state.mn.us:1335 (376 data bytes)
Jan 25 16:40:37 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
server4.hostu.net:1038 (376 data bytes)
Jan 25 16:40:45 sarkmekawk iplog[234]: UDP: dgram to port 1434 from
61.135.134.154:3935 (376 data bytes)

That is only a very small portion of the log. There are hundreds more
entries.




*********************************************************
** P&O - Celebrating 150 Years in Australia: 1852-2002 **
*********************************************************




-- 
Until later: Geoffrey		esoteric at 3times25.net

The latest, most widespread virus?  Microsoft end user agreement.
Think about it...

_______________________________________________
Ale mailing list
Ale at ale.org
http://www.ale.org/mailman/listinfo/ale