A worm that computer security officials have known about since last
summer virtually halted Internet traffic over the weekend in some parts of
the world.
The worm, reportedly called “Sapphire” or “Slammer,” affected servers
through a well-publicized vulnerability in Microsoft
SQL Server 2000. Once it attaches to a server it transmits multiple data
requests in a random manner to other addresses on the Internet looking for
more vulnerable servers to infect. Because of the self-replicating nature, it
quickly spread. MSNBC reported that as many as 25,000 servers were
affected. Reuters reported the worm crashed almost all Internet
services in South Korea and slowed systems in Japan, Europe and the United
States. Overall, five of the 13 root nameservers for the Internet were disabled, according to Slashdot.
But last July’s original security advisory about the vulnerability
certainly wasn’t the first
time SQL users were told to patch their systems. Nor was it the only time.
Yet system administrators were still left scrambling over the weekend to
recover from the latest fiasco.
“People need to do a better job about fixing vulnerabilities,” Howard
Schmidt, President Bush’s No. 2 cyber-security adviser, told the Associated Press.
Worse yet, the worm was remarkably similar to the Code Red
worm, which in July 2001 again plagued Microsoft users that relied on
its now notorious Internet Information Services (IIS) web server.
CERT issued an advisory on Saturday. The patch has been available here from the Microsoft TechNet site for some time now.
