|
 |
CERT® Advisory CA-2001-19 "Code Red" Worm Exploiting Buffer Overflow In IIS Indexing Service DLLOriginal release date: July 19, 2001Last revised: January 17, 2002 Source: CERT/CC A complete revision history can be found at the end of this file.
The CERT/CC has received reports of new self-propagating malicious
code that exploits IIS-enabled systems susceptible
to the vulnerability described in CERT advisory
CA-2001-13 Buffer Overflow In IIS Indexing Service DLL. Other
systems not directly vulnerable to this exploit may also be impacted.
Reports indicate that two variants of the "Code Red" worm may have already affected more
than 250,000 hosts. A translation of this advisory into Polish is available at http://www.cert.pl/CA/CA-2001-19-PL.html.
Attack CycleThe "Code Red" worm attack proceeds as follows:
System FootprintThe "Code Red" worm activity can be identified on a machine by the presence of the following string in a web server log files: The presence of this string in a log file does not neccessarily indicate compromise. Rather it only implies that a "Code Red" worm attempted to infect the machine./default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3% u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531 b%u53ff%u0078%u0000%u00=a Additionally, web pages on victim machines may be defaced with the following message: HELLO! Welcome to http://www.worm.com! Hacked By Chinese! The text of this page is stored exclusively in memory and is not written to disk. Therefore, searching for the text of this page in the file system may not detect compromise. Network FootprintA host running an active instance of the "Code Red" worm scans random IP addresses on port 80/TCP looking for other hosts to infect.
Additional detailed analysis of this worm has been published by eEye Digital Security at http://www.eeye.com. II. ImpactIn addition to possible web site defacement, infected systems may experience performance degradation as a result of the scanning activity of this worm. This degradation can become quite severe since it is possible for a worm to infect a machine multiple times simultaneously. Non-compromised systems and networks that are being scanned by other hosts infected by the "Code Red" worm may experience severe denial of service. In the earlier variant, this occurs because each instance of the "Code Red" worm uses the same random number generator seed to create the list of IP addresses it scans. Therefore, all hosts infected with the earlier variant scan the same IP addresses. This behavior is not found in the later variant, but the end result is the same due to the use of improved randomization techniques that facilitates more prolific scanning. Furthermore, it is important to note that while the "Code Red" worm appears to merely deface web pages on affected systems and attack other systems, the IIS indexing vulnerability it exploits can be used to execute arbitrary code in the Local System security context. This level of privilege effectively gives an attacker complete control of the victim system. III. SolutionsThe CERT/CC encourages all Internet sites to review CERT advisory CA-2001-13 and ensure workarounds or patches have been applied on all affected hosts on your network. If you believe a host under your control has been compromised, you may wish to refer to
Since the worm resides entirely in memory, a reboot of the machine will
purge it from the system. However, patching the system for the underlying
vulnerability remains imperative since the likelihood of re-infection is quite
high due to the rapid propagation of the worm.
This appendix contains information provided by vendors for this
advisory. When vendors report new information to the CERT/CC, we
update this section and note the changes in our revision history. If
a particular vendor is not listed below, we have not received their
comments. Cisco has published a security advisory describing this vulnerability at
The following document regarding the vulnerability exploited by the "Code Red"
worm is available from Microsoft: Author(s): Roman Danyliw and Allen Householder This document is available from: http://www.cert.org/advisories/CA-2001-19.html CERT/CC Contact Information
Phone: +1 412-268-7090 (24-hour hotline) Fax: +1 412-268-6989 Postal address: CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends. Using encryptionWe strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from If you prefer to use DES, please call the CERT hotline for more information. Getting security informationCERT publications and other security information are available from our web site
* "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office.
NO WARRANTY Conditions for use, disclaimers, and sponsorship information
Copyright 2001 Carnegie Mellon University. Revision History Jul 19, 2001: Initial release Jul 20, 2001: Multiple variants, vendor information Jul 30, 2001: Clarification of systems affected, attack cycle; addition of link to Polish translation Aug 16, 2001: Updated link to Microsoft cumulative patch Aug 23, 2001: Updated contact information Jan 17, 2002: Removed Reporting section, updated feedback link |
