SQL Slammer

The Slammer worm targets versions of Microsoft SQL Server 2000 products, as well as MSDE 2000 and related packages. The outbreak began on 25 January 2003 (GMT). According to early reports, the worm had a very significant presence around the world in less than one hour, and the peak time of the worm lasted for about three hours. During the worm's initial outbreak, Internet users experienced large percentage packet drops that developed into a large-scale DoS attack.

The worm exploits a stack-based overflow that occurs in a DLL implementing the SQL Server Resolution Service. This DLL (ssnetlib.dll) is used by the SQL Server service process called SQLSERVR.EXE. The vulnerability had been reported to Microsoft by David Litchfield (NGSSoftware), along with a few others. Furthermore, exploit code was made available at a BlackHat conference in 2002 and it is clear that this code was used as a base from which to develop the worm.

The worm targets TCP port 1433.