All things related to multicast

[Marshall Eubanks <>]

Some of you may have heard about the 1434 worm :

This is a very bad attack going on today since about midnight EST last 
night.

The message below indicates that the worm may be sending UDP Multicast. 
If so, this may cause real
problems with MSDP, along the lines of the Ramen worm.
I haven't seen anything yet, but MSDP peers should probably watch out.

It is a worm that will
- attack MS SQL through port 1434 UDP
- generate amazing amounts of traffic outbound
- systematically try and find and infect other SQL machines

If you are running MS SQL it is listening to port 1434, so you may have 
a problem.

Technical details
http://www.nextgenss.com/advisories/mssql-udp.txt

Marshall

Begin forwarded message:

> From: "Jamie - i-Dot" 
> <>
> Date: Sat Jan 25, 2003  03:57:43  AM US/Eastern
> To: 
>
> Subject: [isp-webhosting] Re: root server attack
> Reply-To: 
>
>
> Noticing the same here,
>
> Some customers seem to be infected / sending out UDP packets to
> multicast addresses,
>
> Tracked it down to SQL server agent on a few boxes...
>
> Strangely enough, LINX doesn't seem to be showing any excess traffic at
> all.
>
> -----Original Message-----
> From: Metanet Help Desk 
> [mailto:]
> Sent: 25 January 2003 07:55
> To: 
>
>
> We are seeing the signs of a wide-scale attack against root servers on
> the internet. This is directed at the internet in general and the
> affects are being felt wide-spread.  Every other provider we have been
> in contact with is aware of this.  You may experience intermittent
> connectivity issues while these are happening and the connectivity
> issues may occur more frequently if these attacks are not stopped
> quickly.
>
>
> ----- Original Message -----
> From: "Gary Carr" 
> <>
> To: 
> <>
> Sent: Saturday, January 25, 2003 2:08 AM
> Subject: [isp-webhosting] Re: Win FTP Servers
>
>
> Anyone have a clue what the major attack going on this am is? All of our
> upstreams over having network-wide problems.
>
>
>
> Gary
>
>
>
> > At 1/22/2003, you wrote:
> > > I'm investigating for an Windows-based FTP server. Security and
> > > ease-of-use are my basic concerns. I don't care much about bells and
> whistles.
> > > Any suggestions?
> >
> > http://www.wftpd.com/
> >
> > WFTPD is very easy to setup and maintain.  I've been very happy with
> > it.  And it's cheap.
> >
> > --Dave
> >
> >
> > __________   The ISP-WEBHOSTING Discussion List   __________
> > To Join: 
> > mailto:
> > To Remove: 
> > mailto:
> > Archives: http://isp-lists.isp-planet.com/isp-webhosting/archives/
>
>
>
> __________   The ISP-WEBHOSTING Discussion List   __________
> To Join: 
> mailto:
> To Remove: 
> mailto:
> Archives: http://isp-lists.isp-planet.com/isp-webhosting/archives/
>
>
>
> __________   The ISP-WEBHOSTING Discussion List   __________
> To Join: 
> mailto:
> To Remove: 
> mailto:
> Archives: http://isp-lists.isp-planet.com/isp-webhosting/archives/
>
>
>
>
> __________  The ISP-WEBHOSTING Discussion List  __________
> To Join: 
> mailto:
> To Remove: 
> mailto:
> Archives: http://isp-lists.isp-planet.com/isp-webhosting/archives/
                                 Regards
                                 Marshall Eubanks

This e-mail may contain confidential and proprietary information of
Multicast Technologies, Inc, subject to Non-Disclosure Agreements

T.M. Eubanks
Multicast Technologies, Inc.
10301 Democracy Lane, Suite 410
Fairfax, Virginia 22030
Phone : 703-293-9624       Fax     : 703-293-9609
e-mail : 

http://www.multicasttech.com

Test your network for multicast :
http://www.multicasttech.com/mt/
 Status of Multicast on the Web  :
 http://www.multicasttech.com/status/index.html