MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!

[Michael Bacarella]

I'm getting massive packet loss to various points on the globe.
I am seeing a lot of these in my tcpdump output on each
host.

02:06:31.017088 150.140.142.17.3047 > 24.193.37.212.ms-sql-m: udp 376
02:06:31.017244 24.193.37.212 > 150.140.142.17: icmp: 24.193.37.212 udp port ms-sql-m unreachable [tos 0xc0

It looks like there's a worm affecting MS SQL Server which is
pingflooding addresses at some random sequence.

All admins with access to routers should block port 1434 (ms-sql-m)!

Everyone running MS SQL Server shut it the hell down or make
sure it can't access the internet proper!

I make no guarantees that this information is correct, test it
out for yourself!

--
Michael Bacarella 24/7 phone: 646 641-8662
Netgraft Corporation http://netgraft.com/
"unique technologies to empower your business"

Finger email address for public key. Key fingerprint:
C40C CB1E D2F6 7628 6308 F554 7A68 A5CF 0BD8 C055

[Carlos Eduardo Vianna]

In-Reply-To: <20030125021141.A23211@romulus.netgraft.com>

Michael,

You're correct. We started to get flooded at 03:00 AM
(now its 09:20 am down here), and found the solution
about 30 min after: shutting down all W2K SQLs. Now we
have all 1434 and 1433 blocked. 1433 seems to be
important too.

Please check this:

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-039.asp

We had troubble downloading the patch.. too busy. I got
it now, and made a mirror. Please feel free to get it
and patch your SQL 2k.

http://thor.stech.psi.br/ms-update/Q323875_SQL2000_SP2_en.EXE


Regards
Carlos Eduardo Vianna - cvianna@stech.net.br
SouthTech Internet DataCenter
http://www.stech.net.br/


>Received: (qmail 1867 invoked from network); 25 Jan
2003 08:39:23 -0000
>Received: from outgoing3.securityfocus.com
(205.206.231.27)
> by mail.securityfocus.com with SMTP; 25 Jan 2003
08:39:23 -0000
>Received: from lists.securityfocus.com
(lists.securityfocus.com [205.206.231.19])
> by outgoing3.securityfocus.com (Postfix) with QMQP
> id A5DACA30A5; Sat, 25 Jan 2003 00:59:36 -0700 (MST)
>Mailing-List: contact bugtraq-help@securityfocus.com;
run by ezmlm
>Precedence: bulk
>List-Id: <bugtraq.list-id.securityfocus.com>
>List-Post: <mailto:bugtraq@securityfocus.com>
>List-Help: <mailto:bugtraq-help@securityfocus.com>
>List-Unsubscribe:
<mailto:bugtraq-unsubscribe@securityfocus.com>
>List-Subscribe:
<mailto:bugtraq-subscribe@securityfocus.com>
>Delivered-To: mailing list bugtraq@securityfocus.com
>Delivered-To: moderator for bugtraq@securityfocus.com
>Received: (qmail 28308 invoked from network); 25 Jan
2003 07:06:20 -0000
>Date: Sat, 25 Jan 2003 02:11:41 -0500
>From: Michael Bacarella <mbac@netgraft.com>
>To: nylug-talk@nylug.org, wwwac@lists.wwwac.org,
> linux-elitists@zgp.org
>Subject: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT
1434!
>Message-ID: <20030125021141.A23211@romulus.netgraft.com>
>Mime-Version: 1.0
>Content-Type: text/plain; charset=us-ascii
>Content-Disposition: inline
>User-Agent: Mutt/1.2.5i
>Resent-From: mbac@romulus.netgraft.com
>Resent-Date: Sat, 25 Jan 2003 02:12:54 -0500
>Resent-To: bugtraq@securityfocus.com
>Resent-Message-Id:
<20030125071254.1B3F7681AD@romulus.netgraft.com>
>
>I'm getting massive packet loss to various points on
the globe.
>I am seeing a lot of these in my tcpdump output on each
>host.
>
>02:06:31.017088 150.140.142.17.3047 >
24.193.37.212.ms-sql-m: udp 376
>02:06:31.017244 24.193.37.212 > 150.140.142.17: icmp:
24.193.37.212 udp port ms-sql-m unreachable [tos 0xc0
>
>It looks like there's a worm affecting MS SQL Server
which is
>pingflooding addresses at some random sequence.
>
>All admins with access to routers should block port
1434 (ms-sql-m)!
>
>Everyone running MS SQL Server shut it the hell down
or make
>sure it can't access the internet proper!
>
>I make no guarantees that this information is correct,
test it
>out for yourself!
>
>--
>Michael Bacarella 24/7 phone: 646
641-8662
>Netgraft Corporation
http://netgraft.com/
> "unique technologies to empower your business"
>
>Finger email address for public key. Key fingerprint:
> C40C CB1E D2F6 7628 6308 F554 7A68 A5CF 0BD8 C055
>

[Umit Tiric]

In-Reply-To: <20030125021141.A23211@romulus.netgraft.com>

We can confirm it here in Toronto, Canada. Even though the effect was
minimal to us, we saw many major networks dissappear on the Internet.

The effect is like a LAN denial of service attack. The requests are
distributed over port 1434 UDP to multicast addresses. If the multicast
on the router is enabled, this can multiply the effect to WAN.

You have to patch your MS-SQL Server to the highest service pack.

But, here is the funny thing, we had a MS-Project Server 2002 installed
on a test machine with MSDE running. There is no service pack 3 for MSDE
2000 yet, but there is a hotfix to solve the problem.

That hotfix requires service pack 2. When we tried to install service
pack 2 for MSDE, it gave an error. On the Microsoft web site, it says
that SOME! of the MSDE installations require the service pack 2 to be
installed only from an update CD but not from the Internet.

I think it's going to be a while for all the networks to install these
patches properly to stop these attack.

Meanwhile I also recommend the sys admins to block the outgoing
1434TCP/UDP as well. Incoming blocking might protect some of your servers
but if you are already effected, at least try to contain this in your LAN
by blocking the outgoing ports.

I hope someone will reverse engineer this worm and tell us exactly what
it did.

Umit

>It looks like there's a worm affecting MS SQL Server which is
>pingflooding addresses at some random sequence.
>
>All admins with access to routers should block port 1434 (ms-sql-m)!
>
>Everyone running MS SQL Server shut it the hell down or make
>sure it can't access the internet proper!
>
>I make no guarantees that this information is correct, test it
>out for yourself!

[Geoff Shively]

Just to affirm this data, several of our servers are trapping the same
packet(s). This worm has gained much power in a small amount of time and
once again, has hit overnight and on a weekend. It is important that we
raise immediate awareness relating to this worm that we have internally
dubbed 'SQ_Hell'. Seemingly stems from this advisory by NGSSoftware Insight
Security: http://www.nextgenss.com/advisories/mssql-udp.txt

"Microsoft's database server SQL Server 2000 exhibits two buffer overrun
vulnerabilities that can be exploited by a remote attacker without ever
having to authenticate to the server."


Additional Data:
Qh.dllhel32hkernQhounthickChGeTf.llQh32.dhws2_f.et sockf.to.Qhsend


Cheers,
Geoff Shively, CHO
PivX Solutions

http://www.pivx.com




----- Original Message -----
From: "Michael Bacarella" <mbac@netgraft.com>
To: <nylug-talk@nylug.org>; <wwwac@lists.wwwac.org>;
<linux-elitists@zgp.org>
Sent: Friday, January 24, 2003 11:11 PM
Subject: MS SQL WORM IS DESTROYING INTERNET BLOCK PORT 1434!


> I'm getting massive packet loss to various points on the globe.
> I am seeing a lot of these in my tcpdump output on each
> host.
>
> 02:06:31.017088 150.140.142.17.3047 > 24.193.37.212.ms-sql-m: udp 376
> 02:06:31.017244 24.193.37.212 > 150.140.142.17: icmp: 24.193.37.212 udp
port ms-sql-m unreachable [tos 0xc0
>
> It looks like there's a worm affecting MS SQL Server which is
> pingflooding addresses at some random sequence.
>
> All admins with access to routers should block port 1434 (ms-sql-m)!
>
> Everyone running MS SQL Server shut it the hell down or make
> sure it can't access the internet proper!
>
> I make no guarantees that this information is correct, test it
> out for yourself!
>
> --
> Michael Bacarella 24/7 phone: 646 641-8662
> Netgraft Corporation http://netgraft.com/
> "unique technologies to empower your business"
>
> Finger email address for public key. Key fingerprint:
> C40C CB1E D2F6 7628 6308 F554 7A68 A5CF 0BD8 C055
>
>

[Tom Kyle]

Am also seeing this. Whatever it is, it's EXTREMELY talkative. Filled up
my PIX 535's memory with its connections. And that was two infected hosts.
This is nasty, just nasty. Shooting from the hip, it looks like it might
(emphasis on might) be infecting via IIS.

Tom

Thomas A. Kyle
University of Missouri-St. Louis
tkyle@jinx.umsl.edu
(314) 516-6012

>
> I'm getting massive packet loss to various points on the globe.
> I am seeing a lot of these in my tcpdump output on each
> host.
>
> 02:06:31.017088 150.140.142.17.3047 > 24.193.37.212.ms-sql-m: udp 376
> 02:06:31.017244 24.193.37.212 > 150.140.142.17: icmp: 24.193.37.212 udp port ms-sql-m unreachable [tos 0xc0
>
> It looks like there's a worm affecting MS SQL Server which is
> pingflooding addresses at some random sequence.
>
> All admins with access to routers should block port 1434 (ms-sql-m)!
>
> Everyone running MS SQL Server shut it the hell down or make
> sure it can't access the internet proper!
>
> I make no guarantees that this information is correct, test it
> out for yourself!
>
> --
> Michael Bacarella 24/7 phone: 646 641-8662
> Netgraft Corporation http://netgraft.com/
> "unique technologies to empower your business"
>
> Finger email address for public key. Key fingerprint:
> C40C CB1E D2F6 7628 6308 F554 7A68 A5CF 0BD8 C055
>