Gail Shaw wrote:

> The interesting (and unfortunate) thing about SQL Slammer is that the patch
> that closed the exploit had been released a couple of months before the worm
> appeared. The reason is was so widespread is that most organisations hadn't
> bothered applying any service packs

Indeed. Some of these things use a hole that was patched a week or two 
ago, but some hit really "old" holes that were fixed ages ago.

OTOH, throwing an update onto a home PC is one thing. I guess you have 
to be a tad more careful when it's a production-grade server we're 
talking about...

(I don't know how SQL Slammer works, but wouldn't you have to have SQL 
access exposed to the Internet for it to propogate?)

Ah well, at least I know why I keep getting all those strange entries in 
my web logs... Apparently they're trying to exploit a bug in ISS. ;-)

-- 
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*

Post a reply to this message