Scourge · January 25 2003

The Great Plague of Slammer

Chronicle

At about 05:30 UTC on 25 January 2003 a worm of just 376 bytes, carried in a single UDP packet, began exploiting a buffer overflow in Microsoft SQL Server and MSDE 2000 that had been patched six months earlier. Its population doubled every 8.5 seconds and within about ten minutes it had infected over 90% of vulnerable hosts. The traffic it generated caused network outages, cancelled flights and ATM failures, and was reported to disrupt some 911 emergency call services.

Lesson learned

It proved that a threat can go global before any human can react, and that databases hidden inside other products must also be patched and kept off the Internet.

Prayer of reparation

For those who called for help in those hours and found no line, and for those who worked without rest to bring the networks back, we ask comfort and rest. Grant us the diligence to update in time what others will rely on in their need. Amen.

How it is remembered

Remembered by closing database ports to the Internet (1434/UDP first of all), inventorying the SQL engines embedded in products and applying critical patches without waiting six months.