notes.txt

SLAMMER芑愿戢盂&#30721

While there were some intermittent network problems before, it wasn't until about
12:00 AM CST (01/25/03) that the worm started causing serious trauma to
UUNET/Worldcom's backbone.

The worm appears to be abusing a stack overflow vulnerability reported a few
months ago by David Litchfield, the original advisory can be found here:

http://www.nextgenss.com/advisories/mssql-udp.txt

The worm's design allows it work across Windows 2000 service packs
due to the use of sqlsort.dll for the register bounce, LoadLibrary(), and
GetProcAddress() functions.

Disabling the worm is as easy as killing the sqlserver.exe process or
just rebooting the box. Just make sure that you unplug the system from
the network before it comes back up. 

The official patch for SQL Server is SP3, however if you are running
SP2 and can't upgrade for one reason or another, you can use the hotfix
found in this directory: Q323875_SQL2000_SP2_en.EXE

More disassemblies:

http://www.boredom.org/~cstone/worm-annotated.txt
http://www.snafu.freedom.org/tmp/1434-probe.txt
http://www.immunitysec.com/downloads/disassembly.txt
http://www.techie.hopto.org/sqlworm.html
http://www.eeye.com/html/Research/Flash/sapphire.txt

-HD