A 376-byte worm reached most vulnerable hosts within ten minutes

What happened

Just before 05:30 UTC on 25 January 2003, a compact program began exploiting a buffer-overflow flaw in Microsoft SQL Server and its desktop engine, spreading itself in a single 376-byte UDP packet to port 1434. According to the joint measurement study by CAIDA, university and industry researchers, the infected population doubled roughly every 8.5 seconds, and more than 90 percent of vulnerable hosts still reachable on the network were infected within about ten minutes, a rate the researchers describe as the fastest of any worm observed to that point. The worm carried no destructive payload; its damage came from the volume of scanning traffic it generated, which the researchers say caused network outages, cancelled airline flights and interference with some automated teller machines.

Confidence and limits

CAIDA's account is a technical measurement built from monitored network traffic, and it is specific about scan rates and packet structure. A related CAIDA incident summary corroborates the packet size and target port independently of the main paper. The study states the worm reached at least 75,000 infected hosts, a figure the researchers describe as a lower bound derived from observable traffic rather than a complete census, since hosts behind some network configurations would not have been visible to the measurement. Neither document names or attributes the worm's author.

Why it mattered

The flaw the worm exploited had already been fixed by a Microsoft security bulletin rated critical and released on 24 July 2002, six months before the outbreak. The bulletin had recommended installing the patch immediately and, separately, blocking the relevant port at the firewall. CAIDA's report treats the gap between patch availability and the worm's success as the central lesson: a fix existing in principle does not reduce risk until it, or an equivalent control such as network filtering, is actually applied to every reachable instance of the affected service.

Defensive takeaway

Review which of your database and administrative services are reachable from outside your network, and confirm that patch deployment for critical, remotely exploitable flaws is measured in days rather than months.

• Which network-facing services in your environment have not been patched for a critical vulnerability disclosed more than 90 days ago?
• Would your firewall or network segmentation stop a single UDP packet from reaching an internal database server from the open internet?
• Do you monitor for the kind of scanning traffic spike that indicates a self-propagating worm inside your own network, not just at the perimeter?

Slammer's speed made human-driven incident response effectively impossible once the outbreak began, since the most damaging phase was over in about the time it takes to read an alert. The lasting lesson from the CAIDA measurement is not about the worm's cleverness but about patch latency: the vulnerability had a fix on the shelf for half a year before an unrelated trigger turned it into a global outage.