"What is interesting about the so-called SQL Slammer attack, is that the vulnerability in SQL Server had been publicly disclosed at the Black Hat 2022 conference by Next Generation Security Software's co-founder, David Litchfield, who discussed how SQL Server could be made to crash by sending a single byte of data to the open UDP port 1434. It is something that raised alarm bells at Microsoft in how it should respond to security incidents."
"Tom Gallagher is head of the Microsoft Security Response Center (MSRC), which is responsible for issuing all security updates, including Patch Tuesday updates and CVEs (common vulnerability expose). He says: "One of the things that came out of SQL Slammer is rethinking about publishing exploit code." When is the appropriate time and to what level of detail that should be provided? Today, as Gallagher notes, there is industry-wide adoption of coordinated vulnerability disclosure (CVD)."
On January 25, 2003 the Slammer worm exploited a buffer overflow vulnerability in SQL Server 2000, impacting Microsoft database customers. The underlying vulnerability had been publicly demonstrated at Black Hat 2022 by David Litchfield, showing SQL Server could crash from a single byte sent to UDP port 1434, prompting Microsoft to reassess disclosure practices. Tom Gallagher leads the Microsoft Security Response Center, which issues security updates and CVEs. The industry now uses coordinated vulnerability disclosure, enabling researchers to privately report flaws while vendors develop fixes. Microsoft emphasizes transparency and urgent patch deployment to reduce exposure and restrict attacker windows.
Read at Computerweekly
Unable to calculate read time
Collection
[
|
...
]