[ale] New worm destablized Internet

[Jim]

Yep. The New York Times site seems to be hosed this morning. You can get the 
home page, but if you click on any one article, you get an error stating that 
the redirection limit has been exceeded. Looks like they're a victim.

On Saturday 25 January 2003 09:14 am, Transam wrote:
> A new worm started destabilizing the Internet in the wee hours this
> morning.  It spread via a vulnerability in MS SQL, according to reports,
> and that the patch has been out for many months.  It is a 376-byte
> packet that propagates over UDP port 1434 (Microsoft-SQL-Monitor).
> Its effect appears to be diminishing somewhat due to many SysAdmins
> starting to block this port on their firewall.
>
> We have seen attacks against most of our clients' firewalls.
> Those clients with one of our firewalls are immune from this worm
> either entering their networks and even a vulnerable system (such
> as a compromised Laptop) from launching the worm to other systems on
> the Internet.  This is because we always have blocked this and all other
> ports not explicitly opened and because we also always have applied egress
> filtering.  Some may suffer from the loss of bandwidth consumed by the
> worm that has compromised other sites on the Internet not so protected.
>
> We see good access to all of our clients' protected networks.
>
> Best regards,
>
> Bob Toxen, CTO
> Fly-By-Day Consulting, Inc.
> "Your expert in Firewalls, Virus and Spam Filters, VPNs,
> Network Monitoring, and Network Security consulting"
> bob at verysecurelinux.com (e-mail)

_______________________________________________
Ale mailing list
Ale at ale.org
http://www.ale.org/mailman/listinfo/ale