The Patching Friars' AlmanacA calendar of CVE saints
SQL SlammerHoly card for d-sql-slammer, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 UDP1434376 byte SQL Slammer CCCLXXVI OCTETI
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Circle I · Worms

The Demon Slammer, Lightning in a Single Packet

Legend

On 25 January 2003 a worm of just 376 bytes, small enough to fit in a single UDP packet, struck the Microsoft SQL Server Resolution Service with a buffer overflow. In about ten minutes it infected 75,000 hosts, the fastest worm then recorded, slowing half the Internet and upsetting ATMs and emergency services. The patch, adding insult to injury, had been out for six months.

Exorcism

Cast it out by patching database servers (MS02-039) and, above all, keeping them off the Internet. Block UDP port 1434 at the perimeter and apply egress filtering, because a database server has no reason to hurl packets at the whole world.

Technical record

Also known as
Sapphire, W32.SQLExp.Worm
Circle
Circle I · Worms
First seen
2003
Status
Dormant
Weapons (exploited CVEs)
Saint MS02-039 (Slammer)
Works
The Great Plague of Slammer

A 376-byte worm that hit on 25 January 2003, exploiting a buffer overflow in the Microsoft SQL Server Resolution Service over a single UDP packet. It infected about 75,000 hosts in roughly ten minutes, the fastest-spreading worm then recorded, slowing large parts of the Internet and disrupting ATMs and emergency services. The patch had been available for six months.

Sources: en.wikipedia.org · nvd.nist.gov

📅 Add to your calendar

Saints:Google CalendarApple, Outlook and others (.ics)

Observances (feasts, scourges and miracles):Google CalendarApple, Outlook and others (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.