A tiny code that choked the Internet

A concise, formal account of how a small worm exploited a SQL Server vulnerability to cause widespread Internet disruption within minutes, and practical takeaways on patching and network hygiene

The Narrative

When and how it began

On 25 January 2003 the SQL Slammer worm emerged and propagated extremely rapidly by sending small UDP packets to the SQL Server Resolution Service on port 1434, causing massive traffic congestion and service disruptions across the Internet.

How it spread and why it worked

The worm exploited a buffer‑overflow vulnerability in Microsoft SQL Server/MSDE; its payload fit in a single 376‑byte UDP packet and used random scanning to find vulnerable hosts. The resulting surge of UDP traffic overwhelmed routers and network infrastructure, amplifying outages.

Key operational notes

A patch for the vulnerability had been available about six months earlier, yet many systems remained unpatched; the worm infected an estimated ~75,000 hosts within ten minutes and caused cascading router failures. The incident underscores the operational necessity of timely patch management, network filtering, and proactive vulnerability scanning.

Social Sharing

A practical security rule

Prioritize rapid patch deployment, continuous vulnerability assessment, and simple network controls—small preventive steps can avert large‑scale outages.