Slammer
Threat LevelDamageDistribution

Effects 

Slammer has the following effects:

• It increases the network traffic through UDP port 1434 (SQL Server Resolution Service Port).
• It slows down or even blocks the server.
• It slows down Internet communications.
• It can cause the e-mail service to fail.
• It can block the network.

Infection strategy 

Slammer follows the infection routine below:

• When it reaches the computer it goes memory resident.
• It loads three Winsock (network management standard) API functions:
  Socket and Sendto (WSW_32.DLL), in order to send itself out.
  GetTickCount (KERNELL32.DLL), to generate random IP addresses in order to try and infect other machines.
• It sends multiple packets containing the worm's code through port 1434.
• The worm constantly sends multiple packets, which results in a DoS (denial of service) attack on the port.

Slammer does not create or modify files or entries in the Windows Registry.

Means of transmission 

Slammer is sent to the affected server from another SQL server. Once it gets into the machine, Slammer looks for other machines that act as SQL servers in order to infect them. It does this by exploiting a buffer overrun vulnerability, which exists in servers that do not have Service Pack 3 installed.