ADVISORY/Entercept Stops the SQL Worm; Also known as: Microsoft SQL Spida Worm Propagation, Digispid.B.Worm, and SQLSnake.

Business/News Editors & High-Tech Writers

ADVISORY...

SAN JOSE, Calif.--(BUSINESS WIRE)--May 23, 2002

Overview

A new Internet worm is targeting Microsoft SQL servers. Remote probes of TCP port 1433, which is the default port used by Microsoft's SQL database, have been reported. According to the SANS Institute, the worm, which is written in JavaScript, gains SQL administrator access and allows the hacker to execute commands, which include reading and writing files, as well as executing code. Microsoft issued a patch for this vulnerability in April 2002.

Ports Affected: TCP port 1433 (The SANS Institute lists port 1433 is among the top five ports under attack)

Details

SQL Server 7 is by default, configured to run without an administrator password. Using TCP port 1433 as a gateway, the worm modifies the "sa" user password, extracts the password file, and forces the machine to scan for additional targets using as many as 100 threads. The SQL worm then e-mails a list of passwords captured from the victim server to a free e-mail account hosted in Singapore.

Major Aspects:

1. Changes the "sa" user password to a random value

2. Runs PWDUMP2 to extract passwords

3. Sends the passwords to an e-mail account

4. Spreads causing significant network traffic

Best Practices for Protection/Recommendations:

In order to best counter this threat, Entercept suggests the following:

1. Set your "sa" SQL Server account password. The worm

spreads on computers that have a blank SQL administrator

password.

2. Ensure you are running the most current Entercept agent

(3/19) to stop

-- confidential information from being sent to the hacker

-- the spread of the worm

3. Using Entercept, set the "User added to administrator

Group," security ID=991, to "red" or protect. This will

prevent the infection of an uninfected box.

4. Filter outgoing email messages that have subjects

beginning with "SystemData-"

5. Firewall filtering of incoming/outgoing port 1433

requests.

6. Filter e-mail destination address. The worm Emails the

password file and SQL server data information to

[e-mail].

Information Resources

-- SANS Institute's Incident Response Center -

http://www.incidents.org/index.php

-- MSFT Security Bulletin MS02-020

SQL Extended Procedure Functions Contain Unchecked Buffers

(Q319507)

http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS02-020.asp

(Due to the length of this URL, it may be necessary to

copy and paste this hyperlink into your Internet browser's

URL address field.)

DISCLAIMER STATEMENT: The information in this bulletin is provided by Entercept Security Technologies, Inc. ("Entercept") and is intended to provide information on a particular security issue or incident. Given that each exploitation technique is unique, Entercept makes no claim to prevent any specific exploit related to the vulnerability discussed in this bulletin. Entercept expressly disclaims any and all warranties with respect to the information provided in this bulletin, express or implied or otherwise, including, but not limited to, warranty of fitness for a particular purpose. Under no circumstances may this information be used to exploit vulnerabilities in any other environment.

About Entercept Security Technologies

Entercept Security Technologies is the proven leader in intrusion prevention software. Based on patented technology, Entercept safeguards the entire server by preventing known and unknown malicious attacks. Unlike other security solutions, Entercept uses a combination of behavioral rules and signatures to proactively prevent attacks rather than merely detecting and reporting them after they occur. Strategic partners include Cisco, Check Point, Foundstone and other leading companies. Entercept has received numerous awards and industry recognition, including Network Magazine's 2002 and 2001 Product of the Year, Fortune Small Business Magazine's `65 Big Ideas List', SC Magazine's `Best Pick of the Year 2000 and 2001', InfoWorld magazine's `Business Impact of the Year Award', and InfoWorld magazine's Readers Choice `Security Product of the Year'. www.entercept.com

The information provided is identified, assessed and measured by the Entercept Ricochet(TM) security research team, a leading group of security experts dedicated to collecting and evaluating intelligence against server threats.

About Entercept Ricochet(TM)

Entercept's Ricochet team is a specialized group of security researchers dedicated to identifying, assessing, and evaluating intelligence regarding server threats. The Ricochet team researches current and future avenues of attack and builds this knowledge into Entercept's intrusion prevention solution. Ricochet is dedicated to providing critical, viable security content via security advisories and technical briefs. This content is designed to

educate organizations and security professionals about the nature and severity of Internet security threats, vulnerabilities and exploits. Ricochet: Matt Conover/Monty Ijzerman

(c)Entercept Security Technologies. All rights reserved. Entercept and the Entercept logo are trademarks of Entercept Security Technologies. All other trademarks, trade names or service marks are the property of their respective owners.