Thanks Microsoft!

[Hamma]

CERT Advisory CA-2003-04 MS-SQL Server Worm

   Original release date: January 25, 2003
   Source: CERT/CC

   A complete revision history can be found at the end of this file.

Systems Affected

     * Microsoft SQL Server 2000

Overview

   The  CERT/CC  has  received reports of self-propagating malicious code
   that  exploits  multiple  vulnerabilities in the Resolution Service of
   Microsoft  SQL  Server  2000.  The propagation of this worm has caused
   varied  levels of network degradation across the Internet, in addition
   to the compromise of vulnerable machines

I. Description

   The  worm targeting SQL Server computers is self-propagating malicious
   code  that  most likely exploits two vulnerabilities in the Resolution
   Service   of   Microsoft   SQL   Server   2000   vulnerabilities.  The
   vulnerability   documented   in   VU#370308   allows   the  keep-alive
   functionality  employed by the SQL Server Resolution Service to launch
   a  denial  of  service  against  other hosts. Either the vulnerability
   VU#399260  or  VU#484891  allow for the execution of arbitrary code on
   the SQL Server computer due to a buffer overflow.

       VU#370308 - http://www.kb.cert.org/vuls/id/370308
       VU#399260 - http://www.kb.cert.org/vuls/id/399260
       VU#484891 - http://www.kb.cert.org/vuls/id/484891

   Reports  to  the  CERT/CC  indicate  that  the high volume of 1434/udp
   traffic  generated  between hosts infected with the worm targeting SQL
   Server  computers  may  itself  lead  to performance issues (including
   possible  denial-of-service  conditions)  on  networks  with  infected
   hosts.

   Activity  of  this  worm  is  readily identifiable on a network by the
   presence  of  small  UDP  packets (we have received reports of 376-410
   byte  packets)  from  seemingly  random  IP  addresses from across the
   Internet to port 1434/udp.

II. Impact

   Compromise  by  the  worm indicates that a remote attacker can execute
   arbitrary  code  as the local SYSTEM user on the victim system. It may
   be possible for an attacker to subsequently leverage a local privilege
   escalation exploit in order to gain Administrator access to the victim
   system.

   The  high  volume of 1434/udp traffic generated between hosts infected
   with  the  worm may itself lead to performance issues on networks with
   both infected and targeted, but non-vulnerable hosts.

III. Solution

   Apply a patch

   Administrators  of  all  systems running Microsoft SQL Server 2000 are
   encouraged  to  review  CA-2002-22  and  VU#370308 for detailed vendor
   recommendations regarding installing the patch:

   http://www.microsoft.com/technet/tre...n/MS02-039.asp 

       CA-2002-22 - http://www.cert.org/advisories/CA-2002-22.html
       VU#370308 - http://www.kb.cert.org/vuls/id/370308


   Ingress/Egress filtering

   The following steps are only effective in limiting the damage that can
   be  done  by  systems  already infected with the worm. They provide no
   protection  whatsoever  against the initial infection of systems. As a
   result,   these   steps  are  only  recommended  in  addition  to  the
   preventative steps outlined above, not in lieu thereof.

   Ingress  filtering  manages the flow of traffic as it enters a network
   under  your  administrative  control.  Servers  are typically the only
   machines that need to accept inbound traffic from the public Internet.
   In  the  network  usage  policy of many sites, external hosts are only
   permitted  to initiate inbound traffic to machines that provide public
   services   on  specific  ports.  Thus,  ingress  filtering  should  be
   performed  at  the  border  to  prohibit  externally initiated inbound
   traffic to non-authorized services.

   Egress  filtering  manages  the flow of traffic as it leaves a network
   under your administrative control. There is typically limited need for
   machines providing public services to initiate outbound connections to
   the Internet.

   In  the  case of this worm, employing ingress and egress filtering can
   help  prevent  compromised  systems  on  your  network  from attacking
   systems  elsewhere.  Blocking  UDP  datagrams  with  both  source  and
   destination  ports  1434 from entering or leaving your network reduces
   the  risk  of  external  infected  systems communicating with infected
   hosts inside your network.


   Recovering from a system compromise

   If  you  believe  a  system under your administrative control has been
   compromised, please follow the steps outlined in:

       Steps for Recovering from a UNIX or NT System Compromise
       http://www.cert.org/tech_tips/win-UN...ompromise.html

Lets hear a round of applause for Microsoft!