CERT Advisory CA-2001-19 "Code Red" Worm Exploiting Buffer Overflow In IIS
Indexing Service DLL

   Original release date: July 19, 2001
   Last revised: August 23, 2001
   Source: CERT/CC
   
   A complete revision history can be found at the end of this file.
   
Systems Affected

     * Microsoft Windows NT 4.0 with IIS 4.0 or IIS 5.0 enabled and Index
       Server 2.0 installed
     * Windows 2000 with IIS 4.0 or IIS 5.0 enabled and Indexing services
       installed
     * Cisco CallManager, Unity Server, uOne, ICS7750, Building Broadband
       Service Manager (these systems run IIS)
     * Unpatched Cisco 600 series DSL routers
       
Overview

   The CERT/CC has received reports of new self-propagating malicious
   code that exploits IIS-enabled systems susceptible to the
   vulnerability described in CERT advisory CA-2001-13 Buffer Overflow In
   IIS Indexing Service DLL. Other systems not directly vulnerable to
   this exploit may also be impacted. Reports indicate that two variants
   of the "Code Red" worm may have already affected more than 250,000
   hosts.
   
   A translation of this advisory into Polish is available at
   http://www.cert.pl/CA/CA-2001-19-PL.html.
   
I. Description

   The "Code Red" worm is self-replicating malicious code that exploits a
   known vulnerability in Microsoft IIS servers (CA-2001-13).
   
Attack Cycle

   The "Code Red" worm attack proceeds as follows:
    1. The "Code Red" worm attempts to connect to TCP port 80 on a
       randomly chosen host assuming that a web server will be found.
       Upon a successful connection to port 80, the attacking host sends
       a crafted HTTP GET request to the victim, attempting to exploit a
       buffer overflow in the Indexing Service described in CERT advisory
       CA-2001-13
    2. The same exploit (HTTP GET request) is sent to each of the
       randomly chosen hosts due to the self-propagating nature of the
       worm. However, depending on the configuration of the host which
       receives this request, there are varied consequences.
          + IIS 4.0 and 5.0 servers with Indexing service installed will
            almost certainly be compromised by the "Code Red" worm.
          + Unpatched Cisco 600-series DSL routers will process the HTTP
            request thereby triggering an unrelated vulnerability which
            causes the router to stop forwarding packets.
            [http://www.cisco.com/warp/public/707/cisco-code-red-worm-pub
            .shtml]
          + Systems not running IIS, but with an HTTP server listening on
            TCP port 80 will probably accept the HTTP request, return
            with an "HTTP 400 Bad Request" message, and potentially log
            this request in an access log.
    3. If the exploit is successful, the worm begins executing on the
       victim host. In the earlier variant of the worm, victim hosts with
       a default language of English experienced the following defacement
       on all pages requested from the server:
       
HELLO! Welcome to http://www.worm.com! Hacked By Chinese!

       Servers configured with a language that is not English and those
       infected with the later variant will not experience any change in
       the served content.
       Other worm activity on a compromised machine is time senstive;
       different activity occurs based on the date (day of the month) of
       the system clock.
          + Day 1 - 19: The infected host will attempt to connect to TCP
            port 80 of randomly chosen IP addresses in order to further
            propagate the worm.
          + Day 20 - 27: A packet-flooding denial of service attack will
            be launched against a particular fixed IP address
          + Day 28 - end of the month: The worm "sleeps"; no active
            connections or denial of service
       
System Footprint

   The "Code Red" worm activity can be identified on a machine by the
   presence of the following string in a web server log files:
   
/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%
u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531
b%u53ff%u0078%u0000%u00=a

   The presence of this string in a log file does not neccessarily
   indicate compromise. Rather it only implies that a "Code Red" worm
   attempted to infect the machine.
   
   Additionally, web pages on victim machines may be defaced with the
   following message:
   
HELLO! Welcome to http://www.worm.com! Hacked By Chinese!

   The text of this page is stored exclusively in memory and is not
   written to disk. Therefore, searching for the text of this page in the
   file system may not detect compromise.
   
Network Footprint

   A host running an active instance of the "Code Red" worm scans random
   IP addresses on port 80/TCP looking for other hosts to infect.
   
   Additional detailed analysis of this worm has been published by eEye
   Digital Security at http://www.eeye.com.
   
II. Impact

   In addition to possible web site defacement, infected systems may
   experience performance degradation as a result of the scanning
   activity of this worm. This degradation can become quite severe since
   it is possible for a worm to infect a machine multiple times
   simultaneously.
   
   Non-compromised systems and networks that are being scanned by other
   hosts infected by the "Code Red" worm may experience severe denial of
   service. In the earlier variant, this occurs because each instance of
   the "Code Red" worm uses the same random number generator seed to
   create the list of IP addresses it scans. Therefore, all hosts
   infected with the earlier variant scan the same IP addresses. This
   behavior is not found in the later variant, but the end result is the
   same due to the use of improved randomization techniques that
   facilitates more prolific scanning.
   
   Furthermore, it is important to note that while the "Code Red" worm
   appears to merely deface web pages on affected systems and attack
   other systems, the IIS indexing vulnerability it exploits can be used
   to execute arbitrary code in the Local System security context. This
   level of privilege effectively gives an attacker complete control of
   the victim system.
   
III. Solutions

   The CERT/CC encourages all Internet sites to review CERT advisory
   CA-2001-13 and ensure workarounds or patches have been applied on all
   affected hosts on your network.
   
   If you believe a host under your control has been compromised, you may
   wish to refer to
   
          Steps for Recovering from a UNIX or NT System Compromise
          
   Since the worm resides entirely in memory, a reboot of the machine
   will purge it from the system. However, patching the system for the
   underlying vulnerability remains imperative since the likelihood of
   re-infection is quite high due to the rapid propagation of the worm.
   
Appendix A. - Vendor Information

   This appendix contains information provided by vendors for this
   advisory. When vendors report new information to the CERT/CC, we
   update this section and note the changes in our revision history. If a
   particular vendor is not listed below, we have not received their
   comments.
   
Cisco Systems

   Cisco has published a security advisory describing this vulnerability
   at
   
          http://www.cisco.com/warp/public/707/cisco-code-red-worm-pub.sh
          tml
          
Microsoft Corporation

   The following document regarding the vulnerability exploited by the
   "Code Red" worm is available from Microsoft:
   
          http://www.microsoft.com/technet/security/bulletin/MS01-044.asp
          
Reporting

   The CERT/CC is interested in receiving reports of this activity. If
   machines under your administrative control are compromised, please
   send mail to cert@cert.org with the following text included in the
   subject line: "[CERT#36881]".
     _________________________________________________________________
   
   Author(s): Roman Danyliw and Allen Householder
   ______________________________________________________________________
   
   This document is available from:
   http://www.cert.org/advisories/CA-2001-19.html
   ______________________________________________________________________
   
CERT/CC Contact Information

   Email: cert@cert.org
          Phone: +1 412-268-7090 (24-hour hotline)
          Fax: +1 412-268-6989
          Postal address:
          CERT Coordination Center
          Software Engineering Institute
          Carnegie Mellon University
          Pittsburgh PA 15213-3890
          U.S.A.
          
   CERT/CC personnel answer the hotline 08:00-17:00 EST(GMT-5) /
   EDT(GMT-4) Monday through Friday; they are on call for emergencies
   during other hours, on U.S. holidays, and on weekends.
   
Using encryption

   We strongly urge you to encrypt sensitive information sent by email.
   Our public PGP key is available from
   
   http://www.cert.org/CERT_PGP.key
       
   If you prefer to use DES, please call the CERT hotline for more
   information.
   
Getting security information

   CERT publications and other security information are available from
   our web site
   
   http://www.cert.org/
       
   To subscribe to the CERT mailing list for advisories and bulletins,
   send email to majordomo@cert.org. Please include in the body of your
   message
   
   subscribe cert-advisory
   
   * "CERT" and "CERT Coordination Center" are registered in the U.S.
   Patent and Trademark Office.
   ______________________________________________________________________
   
   NO WARRANTY
   Any material furnished by Carnegie Mellon University and the Software
   Engineering Institute is furnished on an "as is" basis. Carnegie
   Mellon University makes no warranties of any kind, either expressed or
   implied as to any matter including, but not limited to, warranty of
   fitness for a particular purpose or merchantability, exclusivity or
   results obtained from use of the material. Carnegie Mellon University
   does not make any warranty of any kind with respect to freedom from
   patent, trademark, or copyright infringement.
     _________________________________________________________________
   
   Conditions for use, disclaimers, and sponsorship information
   
   Copyright 2001 Carnegie Mellon University.
   
   Revision History
Jul 19, 2001: Initial release
Jul 20, 2001: Multiple variants, vendor information
Jul 30, 2001: Clarification of systems affected, attack cycle; addition of link
 to Polish translation
Aug 16, 2001: Updated link to Microsoft cumulative patch
Aug 23, 2001: Updated contact information