Differences between current version and predecessor to the previous major change of CodeRed.
Other diffs: Previous Revision, Previous Author, or view the Annotated Edit History
| Newer page: | version 5 | Last edited on Friday, August 15, 2003 10:46:31 am | by JohnMcPherson | |
| Older page: | version 1 | Last edited on Monday, July 15, 2002 11:24:16 pm | by CraigBox | Revert |
@@ -1,7 +1,12 @@
+There is no real way to stop a CodeRed attack, other than either disabling your web server or making sure it is up to date with security patches.
+
+See also CodeRedBungle
+
+----
Taken from http://www.cert.org/advisories/CA-2001-19.html.
-!!!CERT® Advisory CA-2001-19 "Code Red" Worm Exploiting Buffer Overflow In IIS Indexing Service DLL
+!!!CERTÂ
® Advisory CA-2001-19 "Code Red" Worm Exploiting Buffer Overflow In IIS Indexing Service DLL
Original release date: July 19, 2001
Last revised: January 17, 2002
Source: CERT/CC
@@ -24,25 +29,25 @@
Attack Cycle
The "Code Red" worm attack proceeds as follows:
-
1. The "Code Red" worm attempts to connect to TCP port 80 on a randomly chosen host assuming that a web server will be found. Upon a successful connection to port 80, the attacking host sends a crafted HTTP GET request to the victim, attempting to exploit a buffer overflow in the Indexing Service described in CERT advisory CA-2001-13
+1. The "Code Red" worm attempts to connect to TCP port 80 on a randomly chosen host assuming that a web server will be found. Upon a successful connection to port 80, the attacking host sends a crafted HTTP GET request to the victim, attempting to exploit a buffer overflow in the Indexing Service described in CERT advisory CA-2001-13
-
2. The same exploit (HTTP GET request) is sent to each of the randomly chosen hosts due to the self-propagating nature of the worm. However, depending on the configuration of the host which receives this request, there are varied consequences.
+2. The same exploit (HTTP GET request) is sent to each of the randomly chosen hosts due to the self-propagating nature of the worm. However, depending on the configuration of the host which receives this request, there are varied consequences.
* IIS 4.0 and 5.0 servers with Indexing service installed will almost certainly be compromised by the "Code Red" worm.
* Unpatched Cisco 600-series DSL routers will process the HTTP request thereby triggering an unrelated vulnerability which causes the router to stop forwarding packets. [http://www.cisco.com/warp/public/707/cisco-code-red-worm-pub.shtml]
* Systems not running IIS, but with an HTTP server listening on TCP port 80 will probably accept the HTTP request, return with an "HTTP 400 Bad Request" message, and potentially log this request in an access log.
-
3. If the exploit is successful, the worm begins executing on the victim host. In the earlier variant of the worm, victim hosts with a default language of English experienced the following defacement on all pages requested from the server:
+3. If the exploit is successful, the worm begins executing on the victim host. In the earlier variant of the worm, victim hosts with a default language of English experienced the following defacement on all pages requested from the server:
HELLO! Welcome to !http://www.worm.com! Hacked By Chinese!
-
Servers configured with a language that is not English and those infected with the later variant will not experience any change in the served content.
+Servers configured with a language that is not English and those infected with the later variant will not experience any change in the served content.
-
Other worm activity on a compromised machine is time senstive; different activity occurs based on the date (day of the month) of the system clock.
+Other worm activity on a compromised machine is time senstive; different activity occurs based on the date (day of the month) of the system clock.
* Day 1 - 19: The infected host will attempt to connect to TCP port 80 of randomly chosen IP addresses in order to further propagate the worm.
* Day 20 - 27: A packet-flooding denial of service attack will be launched against a particular fixed IP address
* Day 28 - end of the month: The worm "sleeps"; no active connections or denial of service
@@ -77,9 +82,10 @@
Non-compromised systems and networks that are being scanned by other hosts infected by the "Code Red" worm may experience severe denial of service. In the earlier variant, this occurs because each instance of the "Code Red" worm uses the same random number generator seed to create the list of IP addresses it scans. Therefore, all hosts infected with the earlier variant scan the same IP addresses. This behavior is not found in the later variant, but the end result is the same due to the use of improved randomization techniques that facilitates more prolific scanning.
Furthermore, it is important to note that while the "Code Red" worm appears to merely deface web pages on affected systems and attack other systems, the IIS indexing vulnerability it exploits can be used to execute arbitrary code in the Local System security context. This level of privilege effectively gives an attacker complete control of the victim system.
-III. Solutions
+
+!!!
III. Solutions
The CERT/CC encourages all Internet sites to review CERT advisory CA-2001-13 and ensure workarounds or patches have been applied on all affected hosts on your network.
If you believe a host under your control has been compromised, you may wish to refer to
