Code Red, Slammer and the patch gap

On 19 July 2001 a worm called Code Red infected more than 359,000 web servers in under 14 hours, at its peak more than 2,000 new ones a minute. It exploited a buffer overflow in an extension of Microsoft's IIS web server that had been made public, with a fix from Microsoft, a month earlier.

Shortly before 05:30 UTC on Saturday 25 January 2003, Slammer did it faster. The whole worm was 376 bytes, small enough to travel in a single UDP packet to port 1434 on Microsoft SQL Server 2000 and its desktop edition, MSDE. It infected more than 90% of vulnerable hosts within ten minutes, at least 75,000 machines, and the traffic it generated took down parts of Bank of America's ATM network, cancelled flights and disrupted 911 terminals in Bellevue, Washington. The flaw had been found and patched in July 2002.