A denial of service security issue about the W32.Slammer worm

Article translations Article translations
Article ID: 813440 - View products that this article applies to.
This article has been archived. It is offered "as is" and will no longer be updated.
Expand all | Collapse all

SUMMARY

The Microsoft PSS Security Response Team has issued an alert to inform customers about the W32.Slammer worm. The W32.Slammer worm is an Internet worm that targets SQL Server 2000 and SQL Server Desktop Engine (also known as MSDE 2000) systems. This attack results in a high volume of network traffic on both the Internet and private internal networks.

Note that:
  • The W32.Slammer worm does not target operating systems.
  • This alert is primarily focused on business customers.

Risk

You are potentially at risk if:
  • You use one of the products listed in the "Applies to" section of this article.

    -and-
  • You have not applied any of the following patches:
Microsoft Security Bulletin MS02-039
http://www.microsoft.com/technet/security/bulletin/MS02-039.mspx

Microsoft Security Bulletin MS02-061
http://www.microsoft.com/technet/security/bulletin/MS02-061.mspx

The MS02-061 cumulative security patch includes the patch referenced by MS02-039. This patch has been re-released to include functionality that previously was only available in the Q317748.exe download file:
317748 FIX: Handle leak occurs in SQL Server when service or application repeatedly connects and disconnects with shared memory network library

Latest SQL Server 2000 Service Pack
290211 How to obtain the latest SQL Server 2000 service pack

Microsoft SQL Server 2000 Service Pack 3 (SP3) includes the patches referenced in the MS02-039 and MS02-061 security bulletins.

MORE INFORMATION

Prevention

To help protect against this worm, Microsoft recommends the following:

If you are running Microsoft SQL Server 2000 Evaluation Edition, RTM and Service Pack 1 (SP1) or MSDE 2000 RTM and Service Pack 1 (SP1):
  • Use the SQL Server Security tools to help secure your computer. For more information, visit the following Microsoft Web site:

    Tools for Combating the Slammer Worm

    -or-
  • Update your version of SQL Server to the latest service pack. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    290211 How to obtain the latest SQL Server 2000 service pack


If you are running SQL Server 2000 Service Pack 2 (SP2) or MSDE 2000 Service Pack 2 (SP2):
  • Use the SQL Server Security tools to help secure your computer. For more information, visit the following Microsoft Web site:

    Tools for Combating the Slammer Worm

    -or-
  • Update your version of SQL Server to the latest service pack. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
    290211 How to obtain the latest SQL Server 2000 service pack

    -or-
  • Install the latest cumulative security patch, Microsoft Security Bulletin MS02-061. For more information, visit the following Microsoft Web site:

    Microsoft Security Bulletin MS02-061


Recovery

If your computer is infected by the W32.Slammer worm, which is a denial of service attack, Microsoft recommends that you use the following methods to remove the worm:
  • Automated removal

    Use the SQL Server Security tools to remove the the W32.Slammer worm from your computer. These tools can patch infected systems and also help to prevent future infection. For more information, visit the following Microsoft Web site:

    Tools for Combating the Slammer Worm
  • Manual removal

    To manually remove the worm, follow these steps:
    1. Set the SQL Server Service to Manual.
    2. Restart the infected computer.
    3. Follow the instructions in the "Prevention" section of this article about how to patch your computer, depending on the version of SQL Server or MSDE you are running.
    4. Set the SQL Server Service to Automatic.

REFERENCES

For the most current information about this alert, visit the following Microsoft Web site:
http://www.microsoft.com/security/portal/
For more information about a patch for Microsoft Application Center 2000, click the following article number to view the article in the Microsoft Knowledge Base:
813115 FIX: W32.Slammer worm exploits MSDE 2000 vulnerability in Application Center 2000

For more information about computer viruses, click the following article number to view the article in the Microsoft Knowledge Base:
129972 Computer viruses: description, prevention, and recovery




Related Security Information

For additional security-related information about Microsoft products, visit the following Microsoft Web site:
http://www.microsoft.com/security
For additional information about viruses, visit the following third-party Web sites:

http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_SQLP1434.A

http://securityresponse.symantec.com/avcenter/venc/data/w32.sqlexp.worm.html

http://vil.nai.com/vil/content/v_99992.htm
Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

Properties

Article ID: 813440 - Last Review: February 27, 2014 - Revision: 9.6
APPLIES TO
  • Microsoft SQL Server 2000 Standard Edition
  • Microsoft SQL Server 2000 Service Pack 1
  • Microsoft SQL Server 2000 Service Pack 2
  • Microsoft SQL Server 2000 Desktop Engine (Windows)
  • Microsoft SQL Server 2000 Desktop Engine (MSDE) SP1
  • Microsoft SQL Server 2000 Desktop Engine (MSDE) SP2
Keywords: 
kbnosurvey kbarchive KB813440

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com