Pope Slammer I

Encyclical

"Unum Pacchettum Sufficit". David Litchfield found an overflow in SQL Server reachable with a single UDP packet to port 1434, and Microsoft fixed it in July 2002. Six months later, in January 2003, SQL Slammer walked in with 376 bytes and doubled every 8.5 seconds, knocking out ATMs and chunks of the internet. The encyclical reminds us that the months between patch and install are the worms' true garden.

Saint page: Saint MS02-039 (Slammer)

Cardinals

OpenSSL SSLv2 client master key overflow (Slapper worm) · Apache chunked-encoding overflow