SQL Slammer worm propagation
| sql-slammer-worm (11153) |  High Risk |
Description:
The SQL Slammer worm, also known as W32/SQLSlam-A, Sapphire, New SQL, Worm.SQL, and Helkern, propagates by exploiting a buffer overflow vulnerability in the Resolution Service in Microsoft SQL Server 2000 or Microsoft Desktop Engine (MSDE) 2000 installations. The main function of the Slammer worm is to continue propagation. No Distributed Denial of Service (DDoS) or backdoor functionality is incorporated into the worm. Infection can be removed with a reboot, however without protection in place, it is likely that vulnerable servers will be quickly re-infected.
The Slammer worm loads Kernel32.dll and WS2_32.dll and then calls GetTickCount, which is used as a seed for a random IP address routine. This routine then continuously sends 376 bytes of exploit and propagation code across port 1434/UDP until the SQL Server process is shut down. The Slammer worm does not prefer to scan local subnet addresses like the Nimda worm. This will limit the speed of propagation across local networks, but this scanning method generates large amounts of traffic that can overwhelm networks.
The Slammer worm seeks to replicate itself and does not try to further compromise servers or retain access to compromised hosts. The Slammer worm does not infect or modify files, it only exists in memory. For more information refer to Internet Security Systems Security Alert, January 25, 2003. See References.
Note: The Slammer worm may also affect Cisco CallManager version 3.3(x), Cisco Unity versions 3.x and 4.x, and Cisco Building Broadband Service Manager versions 5.0 and 5.1, which incorporate the use of either SQL Server 2000 or MSDE 2000.
Consequences:
Gain Access
Remedy:
Administrators should apply the latest cumulative SQL Server patch, as listed in Microsoft Security Bulletin MS03-031, and restart the system in order to protect against further infection. See References.
Note: Microsoft originally provided a patch for this vulnerability in MS02-061, but it was superseded by the patch released with MS03-031.
As a workaround, administrators should block UDP port 1433 and UDP port 1434 traffic to protect SQL Server databases with a firewall or packet filter.
For Cisco CallManager, Cisco Unity, and Cisco Building Broadband Service Manager: Refer to Cisco Security Advisory 2003 January 26 05:30 GMT for upgrade or patch information. See References.
References:
- CERT Advisory CA-2003-04: MS-SQL Server Worm.
- Cisco Security Notice 2003 January 25 14:00:00 UTC: MS SQL Worm Mitigation Recommendations.
- cisco-sa-20030126-ms02-061: Cisco Security Advisory: Microsoft SQL Server 2000 Vulnerabilities in Cisco Products - MS02-061.
- eEye Digital Security Alert AL20030125: SQL Sapphire Worm Analysis.
- IBM Internet Security Systems X-Force Database: Microsoft SQL Server Resolution Service stack buffer overflow.
- Internet Security Systems Security Alert, January 25, 2003: Microsoft SQL Slammer Worm Propagation.
- Microsoft Corporation Web site: PSS Security Response Team Alert - New Worm: W32.Slammer.
- Microsoft Security Bulletin MS02-039: Buffer Overruns in SQL Server 2000 Resolution Service Could Enable Code Execution (Q323875).
- Microsoft Security Bulletin MS02-061: Elevation of Privilege in SQL Server Web Tasks (Q316333).
- Microsoft Security Bulletin MS03-031: Cumulative Patch for Microsoft SQL Server (815495).
- National Infrastructure Protection Center (NIPC) Alert Advisory 03-001.1: "Worm Targets SQL Vulnerability".
- NGSSoftware Insight Security Research Advisory #NISR25072002: Unauthenticated Remote Compromise in MS SQL Server 2000.
- SQLSecurity.com Web site: SQL Server/MSDE-Based Applications.
- VERITAS TechNote 254244: W32.SQLExp.Worm "SQL Slammer" (discovered 1/24/2003) causes MSDE components included with Backup Exec 9.0 and ExecView 3.1 to flood the network, and SQLSERVR.EXE may exhibit high CPU utilization.
- BID-5311: Microsoft SQL Server 2000 Resolution Service Stack Overflow Vulnerability
- CVE-2002-0649: Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434 in which (1) a 0x04 byte that causes the SQL Monitor thread to generate a long registry key name, or (2) a 0x08 byte with a long string causes heap corruption, as exploited by the Slammer/Sapphire worm.
Platforms Affected:
- Cisco Building Broadband Service Manager 5.0
- Cisco Building Broadband Service Manager 5.1
- Cisco Unified CallManager 3.3
- Cisco Unity Server 3.0
- Cisco Unity Server 4.0
- Microsoft Data Engine 2000
- Microsoft SQL Server 2000
- Microsoft Windows 2000
- Microsoft Windows NT 4.0
- VERITAS Backup Exec 9.0
- VERITAS ExecView 3.1
Reported:
Jan 25, 2003
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net