Slammer

Slammer, also known as the SQL Slammer worm, was a fast-spreading network worm that targeted Microsoft SQL Server systems by exploiting the SQL Server Resolution Service heap overflow vulnerability CVE-2002-0649 over UDP 1434. It became one of the defining early-2000s Internet worm outbreaks and is widely cited alongside Code Red, Blaster, Sasser, and Conficker as an example of how rapidly self-propagating malware can cause large-scale disruption when patching lags behind exposure.

Slammer propagated by scanning for vulnerable hosts and transmitting its exploit directly over the network, requiring no user interaction once reachable targets were exposed. Its primary impact was denial of service through explosive propagation and network congestion rather than data theft or stealthy persistence. The worm disrupted enterprise and operational environments, including a well-documented incident at the Davis-Besse nuclear power plant in January 2003, where infection of a private network disabled a safety monitoring system for nearly five hours and caused a plant process computer outage for about six hours after entering through an unsecured contractor connection and bypassing perimeter protections.

Slammer is frequently referenced in discussions of critical infrastructure risk because it demonstrated how indiscriminate worm activity against common enterprise software could spill into industrial and safety-related environments. It is also historically associated with attacks against the SQL Server Resolution Service on UDP 1434, which led defenders and platform vendors to recommend blocking or restricting that service where possible and prioritizing rapid patch deployment. Slammer’s outbreak reinforced enduring defensive lessons around vulnerability management, network segmentation, limiting unnecessary exposure of database services, and controlling third-party connectivity.