Security Vulnerabilities in LabVIEW DSC and Lookout - W32/Sdbot.worm

[nickf]

The LabVIEW DSC module and Lookout install the Microsoft MSDE 2000 database. By default, the 'sa' password is left blank.  Several viruses exploit this this known security vulnerability in MSDE 2000.

You can prevent infection by applying a secure 'sa' password to MSDE 2000.

1. Make sure the MSSQL Server service is running
2. Execute the following command line (replace new_password with the desired password):
   osql -U"sa" -P"" -Q"sp_password NULL, 'new_password', 'sa'"

In particular, variants of the W32/Sdbot.worm virus are known to exploit this vulnerability.

Refer to this KB or the DSC Module readme for more information.
<http://digital.ni.com/public.nsf/websearch/42DFA4993437D7EE86256DE800570B39?OpenDocument>

[Ben]

Thank you for getting the word out fast!

1) Which versions of LV DSC installed "MSDE 2000"?

2) How do I "Make sure the MSSQL Server service is running"?

3) How do I start " the MSSQL Server service "?

4) When you said "Execute the following command line " you mean go to Start >>>Run... and paste in the string you provided, correct?

5) If I am using a standard firewall from MacAfee or the like, should I expect a notification when the attack occurs?

Trying to be careful,

Ben

[rolfk]

---

@Ben wrote:

Thank you for getting the word out fast!

1) Which versions of LV DSC installed "MSDE 2000"?

2) How do I "Make sure the MSSQL Server service is running"?

3) How do I start " the MSSQL Server service "?

4) When you said "Execute the following command line " you mean go to Start >>>Run... and paste in the string you provided, correct?

5) If I am using a standard firewall from MacAfee or the like, should I expect a notification when the attack occurs?

Trying to be careful,

Ben

---

1) I believe all LabVIEW DSC systems since 7.0

2) You should see an SQL Server icon in the system tray and selecting it you will see a green arrow if it is running and a red square if it is not. If you have the full version of SQL Server installed or a version such as 2005 this might be different. In my case for the Microsoft SQL Server Development Edition I have a separate application called SQL Server Configuration Manager inside the start menu that shows an overview over this and other things.

3) Click on the icon in the system tray and select start, or go to above mentioned Configuration Manager if available or if you want to go on the deepest level go to the Administrative Tools Control Panel and select Services and in there make the SQL Server service started.

4) I would think a real command console to be a bit more appropriate as you can see the feedback if something went wrong.

5) If the Firewall is worth anything I would strongly expect this yes.

Rolf Kalbermatter

Message Edited by rolfk on 01-10-2007 10:58 PM

[nickf]

>>3) How do I start " the MSSQL Server service "?

You can use the icon in the system tray, or you can use the Administrative Tools>>Service Manager. 
If you have DSC or Lookout installed, and haven't changed any of the default configuration settings, then MSSQL will start automatically.

>>4) When you said "Execute the following command line " you mean go to Start >>>Run... and paste in the string you provided, correct?

That will work.  You can also open a command line window by first executing "cmd".  This will allow you to see the result of the command.

>>5) If I am using a standard firewall from MacAfee or the like, should I expect a notification when the attack occurs?

Not necessarily.  Check with your virus scanner provider on the specifics of a specific virus or worm.

In addition to the NI KB linked above, you can find more information in Microsoft KB 322336:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;q322336