Original release date: July 19, 2001<BR>
Last revised: January 17, 2002<BR>
Source: CERT/CC<BR>
<P>A complete revision history can be found at the end of this file.
<A NAME="affected">
<H3>Systems Affected</H3>
<UL>
<LI>Microsoft Windows NT 4.0 with IIS 4.0 or IIS 5.0 enabled and Index
Server 2.0 installed
<LI>Windows 2000 with IIS 4.0 or IIS 5.0 enabled and Indexing services
installed
<LI>Cisco CallManager, Unity Server, uOne, ICS7750, Building Broadband
Service Manager (these systems run IIS)
<LI>Unpatched Cisco 600 series DSL routers
</UL>
<A NAME="overview">
<H2>Overview</H2>
<P>The CERT/CC has received reports of new self-propagating malicious
code that exploits IIS-enabled systems susceptible
to the vulnerability described in CERT advisory <a
href="http://www.cert.org/advisories/CA-2001-13.html">
CA-2001-13 Buffer Overflow In IIS Indexing Service DLL</a>. Other
systems not directly vulnerable to this exploit may also be impacted.
Reports indicate that two variants of the "Code Red" worm may have already affected more
than 250,000 hosts. </P>
<p><p>A translation of this advisory into Polish is available at <a href="http://www.cert.pl/CA/CA-2001-19-PL.html">http://www.cert.pl/CA/CA-2001-19-PL.html</a>.
</p>
<H2>I. Description</H2>
The "Code Red" worm is self-replicating malicious code that exploits a known
vulnerability in Microsoft IIS servers (<a
href="http://www.cert.org/advisories/CA-2001-13.html">CA-2001-13</A>).
<H4>Attack Cycle</H4>
<P>The "Code Red" worm attack proceeds as follows:</P>
<OL>
<LI>The "Code Red" worm attempts to connect to TCP port 80 on a randomly chosen host
assuming that a web server will be found.
Upon a successful connection to port 80, the attacking host sends a
crafted HTTP GET request to the victim,
attempting to exploit a buffer overflow in the Indexing Service
described in CERT advisory <a
href="http://www.cert.org/advisories/CA-2001-13.html">CA-2001-13</a></LI>
<P>
<LI>The same exploit (HTTP GET request) is sent to each of the randomly chosen hosts due
to the self-propagating nature of the worm.
However, depending on the configuration of the host which receives this request, there are
varied consequences.
<UL>
<P>
<LI><B>IIS 4.0 and 5.0 servers with Indexing service installed</B>
will almost certainly be compromised by the "Code Red" worm.</LI>
<P>
<LI><B>Unpatched Cisco 600-series DSL routers</B> will process the HTTP request
thereby triggering an unrelated vulnerability which causes
the router to stop forwarding packets.
[<A HREF="http://www.cisco.com/warp/public/707/cisco-code-red-worm-pub.shtml">http://www.cisco.com/warp/public/707/cisco-code-red-worm-pub.shtml</A>]</LI>
<P>
<LI><B>Systems not running IIS, but with an HTTP server listening on TCP port 80</B> will probably accept the HTTP request,
return with an "HTTP 400 Bad Request" message, and potentially log this request
in an access log. </LI>
</UL>
<P>
</LI>
<LI>If the exploit is successful, the worm begins executing on the
victim host. In the earlier variant of the worm, victim hosts with a default
language of English experienced the following defacement on all pages requested from
the server:
<BLOCKQUOTE><PRE>
HELLO! Welcome to http://www.worm.com! Hacked By Chinese!
</PRE></BLOCKQUOTE>
Servers configured with a language that is not English and those infected with the
later variant will not experience any change in the served content.
<P>
Other worm activity on a compromised machine is time senstive;
different activity occurs based on the date (day of the month) of the system clock.
<P>
<UL>
<LI><I>Day 1 - 19</I>: The infected host will attempt to connect to TCP port 80 of
randomly chosen IP addresses in order to further propagate the worm.
<LI><I>Day 20 - 27</I>: A packet-flooding denial of service attack will be launched against
a particular fixed IP address
<LI><I>Day 28 - end of the month</I>: The worm "sleeps"; no active connections or denial of
service
</UL>
<P>
</OL>
<h4>System Footprint</h4>
<P>The "Code Red" worm activity can be identified on a machine by the
presence of the following string in a web server log files:</P>
<BLOCKQUOTE>
<FONT FACE="Courier">
<PRE>
/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%
u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531
b%u53ff%u0078%u0000%u00=a
</PRE>
</FONT>
</BLOCKQUOTE>
The presence of this string in a log file does not neccessarily indicate compromise.
Rather it only implies that a "Code Red" worm attempted to infect the
machine.
<P>Additionally, web pages on victim machines may be defaced with the following message:</P>
<BLOCKQUOTE><PRE>
HELLO! Welcome to http://www.worm.com! Hacked By Chinese!
</PRE></BLOCKQUOTE>
<P>The text of this page is stored exclusively in memory and is not
written to disk. Therefore, searching for the text of this page in
the file system may not detect compromise.</P>
<h4>Network Footprint</h4>
<P>A host running an active instance of the "Code Red" worm scans
random IP addresses on port 80/TCP looking for other hosts to infect.
<P>
<P>Additional detailed analysis of this worm has been published by eEye
Digital Security at <a href="http://www.eeye.com">http://www.eeye.com</a>.</P>
<H2>II. Impact</H2>
<P>In addition to possible web site defacement, infected systems may experience
performance degradation as a result of the scanning activity of this
worm. This degradation can become quite severe since it is possible for
a worm to infect a machine multiple times simultaneously. </P>
</P>
<P>
Non-compromised systems and networks that are being scanned by other
hosts infected by the "Code Red" worm may experience severe
denial of service.
In the earlier variant, this occurs because each instance of the "Code
Red" worm uses the same random number generator seed to create the
list of IP addresses it scans. Therefore, all hosts infected with the earlier
variant scan the same IP addresses.
This behavior is not found in the later variant,
but the end result is the same due to the use of improved randomization techniques
that facilitates more prolific
scanning.
</P>
<P>Furthermore, it is important to note that while the "Code Red" worm
appears to merely deface web pages on affected systems and attack
other systems, the IIS indexing vulnerability it exploits can be used
to execute arbitrary code in the Local System security context. This
level of privilege effectively gives an attacker complete control of
the victim system.
<H2>III. Solutions</H2>
<P>The CERT/CC encourages all Internet sites to review CERT advisory <a
href="http://www.cert.org/advisories/CA-2001-13.html">
CA-2001-13</a> and ensure workarounds or patches have been applied on all
affected hosts on your network.</P>
<P>If you believe a host under your control has been compromised, you may wish to refer to</P>
<dl>
<dd><a href="http://www.cert.org/tech_tips/win-UNIX-system_compromise.html">Steps for Recovering from a UNIX or NT System Compromise</a>
</dd>
</dl>
<P>
Since the worm resides entirely in memory, a reboot of the machine will
purge it from the system. However, patching the system for the underlying
vulnerability remains imperative since the likelihood of re-infection is quite
high due to the rapid propagation of the worm.
<A NAME="vendors">
<H2>Appendix A. - Vendor Information</H2>
<P>This appendix contains information provided by vendors for this
advisory. When vendors report new information to the CERT/CC, we
update this section and note the changes in our revision history. If
a particular vendor is not listed below, we have not received their
comments.</P>
<A NAME="cisco">
<H4>Cisco Systems</H4>
<P>Cisco has published a security advisory describing this vulnerability at
<DL><DD>
<A HREF="http://www.cisco.com/warp/public/707/cisco-code-red-worm-pub.shtml">
http://www.cisco.com/warp/public/707/cisco-code-red-worm-pub.shtml</A>
</DL></DD>
<A name="microsoft">
<H4>Microsoft Corporation</H4>
<P>
The following document regarding the vulnerability exploited by the "Code Red"
worm is available from Microsoft:<BR>
<DL><DD>
<A HREF="http://www.microsoft.com/technet/security/bulletin/MS01-044.asp">http://www.microsoft.com/technet/security/bulletin/MS01-044.asp</A>
</DL></DD>
</P>
<!-- end vendor -->
<HR NOSHADE>
<B>Author(s)</B>: <A HREF="mailto:cert@cert.org?Subject=CA-2001-19%20Feedback">Roman Danyliw and Allen Householder</a>
<p></p>
<!--#include virtual="/include/footer_nocopyright.html" -->
<P>Copyright 2001 Carnegie Mellon University.</P>
<P>Revision History
<PRE>
Jul 19, 2001: Initial release
Jul 20, 2001: Multiple variants, vendor information
Jul 30, 2001: Clarification of systems affected, attack cycle; addition of link to Polish translation
Aug 16, 2001: Updated link to Microsoft cumulative patch
Aug 23, 2001: Updated contact information
Jan 17, 2002: Removed Reporting section, updated feedback link
</PRE>
|