{"data":{"case":{"actions":{"de":["Installiere **SQL Server 2000 Service Pack 3**, das den Fix enthält, oder zumindest den Patch aus dem Microsoft-Bulletin **MS02-039** oder seinem Nachfolger MS02-061.","Such auch nach **MSDE 2000**: Es steckt auch in anderen Produkten, etwa in Visual Studio und der Office Developer Edition, und braucht denselben Fix.","Sperre **UDP-Port 1434** in deiner Firewall, damit der Resolution Service aus dem Internet nicht erreichbar ist."],"en":["Install **SQL Server 2000 Service Pack 3**, which contains the fix, or at least the patch from Microsoft bulletin **MS02-039** or its successor MS02-061.","Look for **MSDE 2000** as well: it also ships inside other products, such as Visual Studio and Office Developer Edition, and needs the same fix.","Block **UDP port 1434** at your firewall, so the Resolution Service cannot be reached from the internet."]},"criteria":{"damage":{"de":"Im Kernkraftwerk Davis-Besse war das Safety Parameter Display System 4 Stunden und 50 Minuten nicht verfügbar; Steuerung und Schutzfunktionen der Anlage waren nicht betroffen (US-NRC).","en":"At the Davis-Besse nuclear plant, the safety parameter display system was unavailable for 4 hours 50 minutes; plant control and protection were not affected (US NRC).","met":true},"exploitation":{"de":"Slammer war ein sich selbst verbreitender Wurm, der in 10 Minuten mehr als 90 % der verwundbaren Computer infizierte (Inside the Slammer Worm, 2003).","en":"Slammer was a self-spreading worm that infected more than 90 % of vulnerable computers within 10 minutes (Inside the Slammer Worm, 2003).","met":true},"reach":{"de":"Gezählt wurden mindestens 75.000 infizierte Computer; die tatsächliche Zahl kann höher liegen, doch keine Messung in den Quellen erreicht 100.000 (Inside the Slammer Worm, 2003).","en":"At least 75,000 infected computers were measured; the true number may be higher, but no measurement in the sources reaches 100,000 (Inside the Slammer Worm, 2003).","met":false},"response":{"de":"Der Patch von Microsoft war seit dem 24. Juli 2002 verfügbar; darüber hinaus belegen die Quellen nur, dass Netzwerke UDP-Port 1434 sperrten (Microsoft, Inside the Slammer Worm).","en":"Microsoft's patch had been out since July 24, 2002; beyond it, the sources document only networks blocking UDP port 1434 (Microsoft, Inside the Slammer Worm).","met":false}},"cves":["CVE-2002-0649"],"cvss":7.5,"cvss_version":"2.0","cwe":"CWE-119","dates":[{"date":"2002-07-24","key":"patched"},{"date":"2002-07-25","de":"Microsoft nimmt MSDE 2000 in sein Bulletin auf","en":"Microsoft adds MSDE 2000 to its bulletin"},{"date":"2003-01-25","key":"outbreak"},{"date":"2003-08-29","de":"Die US-Atomaufsicht NRC meldet den Wurm im Netzwerk des Kraftwerks Davis-Besse","en":"The US nuclear regulator NRC reports the worm in the network of the Davis-Besse plant"}],"de":{"credit":"NGSSoftware (Next Generation Security Software, Großbritannien)","fixed":"Microsoft-Patch MS02-039 (24. Juli 2002); enthalten im SQL Server 2000 Service Pack 3","product":"Datenbankserver Microsoft SQL Server 2000 und MSDE 2000","summary":"Ein nur 376 Byte großer Wurm verbreitete sich hundertmal schneller als Code Red und überflutete Netzwerke mit seinem Datenverkehr."},"disclosed":"2003-01-25","en":{"credit":"NGSSoftware (Next Generation Security Software, UK)","fixed":"Microsoft patch MS02-039 (July 24, 2002); part of SQL Server 2000 Service Pack 3","product":"Microsoft SQL Server 2000 and MSDE 2000 databases","summary":"A worm of just 376 bytes spread a hundred times faster than Code Red and flooded networks with its traffic."},"figures":[{"de":"bis mehr als 90 % der verwundbaren Server infiziert waren","en":"to infect more than 90 % of vulnerable servers","value":"10 min"},{"de":"fiel das Safety Parameter Display System im Kernkraftwerk Davis-Besse aus","en":"outage of the safety parameter display system at the Davis-Besse nuclear plant","value":"4 h 50 min"},{"de":"infizierte Computer mindestens, vielleicht erheblich mehr","en":"infected computers at least, perhaps considerably more","value":"75,000"}],"key":"sql-slammer","name":"SQL Slammer","product":"Microsoft SQL Server 2000","sources":[{"de":"Inside the Slammer Worm, IEEE Security \u0026 Privacy (2003, PDF)","title":"Inside the Slammer Worm, IEEE Security \u0026 Privacy (2003, PDF)","url":"https://css.csail.mit.edu/6.566/2018/readings/slammer.pdf"},{"de":"CAIDA: die Ausbreitung des Sapphire/Slammer-Wurms","title":"CAIDA: the spread of the Sapphire/Slammer worm","url":"https://www-old.caida.org/publications/papers/2003/sapphire/sapphire.html"},{"de":"Microsoft-Sicherheitsbulletin MS02-039","title":"Microsoft security bulletin MS02-039","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-039"},{"de":"NVD: CVE-2002-0649","title":"NVD: CVE-2002-0649","url":"https://nvd.nist.gov/vuln/detail/CVE-2002-0649"},{"de":"US-NRC, Information Notice 2003-14: Slammer im Netzwerk des Kernkraftwerks Davis-Besse (PDF)","title":"US NRC Information Notice 2003-14: Slammer in the network of the Davis-Besse nuclear plant (PDF)","url":"https://www.nrc.gov/docs/ML0324/ML032410430.pdf"}],"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","year":2003}},"description":"In January 2003, a worm of just 376 bytes infected more than 90 % of vulnerable Microsoft SQL servers within 10 minutes. How it spread, and what it hit.","language":"en","latest_measurement":"2026-10-23","method":"latency-v3","method_page":"https://crackthe.net/method/","source":"https://crackthe.net/","text":"Early on Saturday, January 25, 2003, a worm called SQL Slammer, also known as Sapphire, infected more than 90 % of the vulnerable computers on the internet within 10 minutes. A worm is a program that spreads from computer to computer on its own. Slammer attacked Microsoft\u0026rsquo;s database software SQL Server 2000 through a flaw that Microsoft had fixed six months earlier, and its traffic alone knocked networks and other systems offline.\nHow it worked SQL Server 2000 can run several copies of the database server, called instances, on one machine. A small helper, the SQL Server Resolution Service, tells programs which network port, a kind of numbered door, each instance uses. The service itself listens on UDP port 1434. UDP is a way of sending single data packets without first setting up a connection.\nOne part of this service copied data from an incoming packet into a memory area of fixed size, a buffer, without checking the length. A single crafted packet could overflow the buffer and run code inside the database server. The same service is part of MSDE 2000, a database engine that Microsoft also shipped inside other products, such as Visual Studio.\nSlammer was nothing more than such a packet: 376 bytes of code, 404 bytes as a complete packet. It carried no harmful payload, only the code to spread itself. Every infected computer sent copies to random addresses as fast as its network connection allowed. Because UDP needs no reply, only the bandwidth of the networks limited the speed. The worm lived only in memory and left no file behind. A restart removed it, but an unpatched server was infected again within minutes.\nInfected serversends copies as fast as its connection allows One UDP packet404 bytes, no connection needed Resolution Servicecopies the packet into a buffer that is too small New victimstarts sending copies at once No reply and no connection setup were needed, so only bandwidth limited how fast the worm spread. Speed and reach Researchers from CAIDA and other institutes reconstructed the outbreak from traffic data and published their study, “Inside the Slammer Worm”, in 2003. A scan in the table below is one attempt to reach a random address.\nTime after releaseWhat happened 0Slammer begins to infect computers, shortly before 05:30 UTC First minuteThe number of infected computers doubles every 8.5 seconds About 3 minutesInfected computers send more than 55 million scans per second in total About 10 minutesMore than 90 % of the vulnerable computers are infected 30 minutesThe researchers have seen 74,856 different infected addresses Within an hourMany networks start to block UDP port 1434 For the Code Red outbreak of 2001, the study gives a doubling time of about 37 minutes. The study calls Slammer two orders of magnitude faster, about a hundred times. A single infected computer sent up to 26,000 scans per second; the average was about 4,000.\nThe researchers counted at least 75,000 infected computers, “perhaps considerably more”. The largest share was in the United States:\nWhere the infected computers were United States42.9 % South Korea11.8 % Location unknown7.0 % China6.3 % Taiwan4.0 % Canada2.9 % Australia2.4 % United Kingdom2.0 % Japan1.7 % Netherlands1.5 % Share of the infected addresses observed, top ten. Source: Inside the Slammer Worm (2003).\nWhat the traffic hit Slammer did not change or delete any data. The harm came from its traffic, which overloaded networks and took other systems offline with them.\nThe best-documented case is the Davis-Besse nuclear power plant in Ohio, in the United States. According to the US Nuclear Regulatory Commission (NRC), the worm got into the plant\u0026rsquo;s network on January 25. The plant\u0026rsquo;s safety parameter display system, which displays key safety readings, was unavailable for 4 hours and 50 minutes, and the plant process computer for 6 hours and 9 minutes. The NRC says that the plant\u0026rsquo;s control and protection functions were not affected.\nPress reports at the time, cited in the study, also named cash machines, emergency call terminals and cancelled flights. There is no reliable figure for the total cost: only press and industry estimates exist.\nThe fix and the response The British firm NGSSoftware had reported the flaw to Microsoft. On July 24, 2002, Microsoft published security bulletin MS02-039 with a patch and the advice: “System administrators should install the patch immediately.” A day later, it added MSDE 2000 to the bulletin, and the fix later became part of SQL Server 2000 Service Pack 3. Microsoft says the patch “is effective in protecting SQL Server 2000 and MSDE 2000 against the SQL Slammer worm”. Six months after its release, at least 75,000 computers still lacked it.\nDuring the outbreak, many networks began within an hour to block all packets to UDP port 1434 in their routers and firewalls. By then, the worm had long reached almost all vulnerable computers.\nThe US National Vulnerability Database rates the flaw 7.5 out of 10 on the older CVSS version 2; it has no score on the newer version 3. The score is not higher because SQL Server normally runs with the rights of an ordinary user account, not with full system rights.","title":"SQL Slammer: the worm that hit 90 % of its targets in 10 minutes","url":"https://crackthe.net/vulnerabilities/sql-slammer/"}