lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
From: John.Airey at rnib.org.uk (John.Airey@...b.org.uk) Subject: SQL Slammer - lessons learned > -----Original Message----- > From: Ron DuFresne [mailto:dufresne@...ternet.com] > Sent: 06 February 2003 18:33 > To: Nicob > Cc: full-disclosure@...ts.netsys.com > Subject: RE: [Full-Disclosure] SQL Slammer - lessons learned > > > > I'm suspecting then alot of you must be just livid that most ISP' and > backbone providers are blocking those udp packets to those > borked M$-sql > servers then? > > There's certain traffic that just does not need to be passed beyond > certain borders, and can have bad effects if it does or is exposed. Like I said, the probability of it affecting you is 64,511/1 per DNS query. However, a large organisation is going to see thousands of queries. Add to that the wonderful ability of IE to "cache" DNS errors and you'll soon see lots of complaints that websites go missing. We used to block over 300 TCP and UDP ports (ie before I realised the problem this was causing), reducing the probability of failure to around 20,000/1. Given thousands of requests daily this is an unacceptable failure rate. Which brings me full circle back to stateful inspection. I can see no business reason why any organisation would need the outside world to initiate sessions to ports other than allowed privileged ports. (I leave the definition of allowed privileged ports undefined as it is an issue between the ISP and its customers. One or two people have digressed onto this issue) Have a look at http://www.rfc-editor.org/rfc/rfc768.txt and http://www.rfc-editor.org/rfc/rfc793.txt for more details on UDP and TCP connections. - John Airey, BSc (Jt Hons), CNA, RHCE Internet systems support officer, ITCSD, Royal National Institute of the Blind, Bakewell Road, Peterborough PE2 6XU, Tel.: +44 (0) 1733 375299 Fax: +44 (0) 1733 370848 John.Airey@...b.org.uk Am I the only person in the UK who finds it strange that our Prime Minister complains of Human Rights abuses around the world, yet wishes to opt out of the European Convention of Human Rights? - NOTICE: The information contained in this email and any attachments is confidential and may be legally privileged. If you are not the intended recipient you are hereby notified that you must not use, disclose, distribute, copy, print or rely on this email's content. If you are not the intended recipient, please notify the sender immediately and then delete the email and any attachments from your system. RNIB has made strenuous efforts to ensure that emails and any attachments generated by its staff are free from viruses. However, it cannot accept any responsibility for any viruses which are transmitted. We therefore recommend you scan all attachments. Please note that the statements and views expressed in this email and any attachments are those of the author and do not necessarily represent those of RNIB. RNIB Registered Charity Number: 226227 Website: http://www.rnib.org.uk
Powered by blists - more mailing lists