|
Code Red II Worm |
| Description
The "Code Red II" worm exploits the same "buffer overflow" vulnerability identified in the previous "Code Red" Worm. Microsoft has published information and patch on this vulnerability in Microsoft Internet Information Server (IIS). http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS01-033.asp When a web server become infected, the worm checks the default language of the system. If the language is Chinese (either Traditional or Simplified), it creates 600 new threads and sleeps for 48 hours, otherwise 300 and sleeps for 24 hours. These threads generate random IP addresses used to search for new web server to infect. When the original thread wake up from its sleep, it will cause the system to be rebooted. In addition, all threads check if the date is October or if it is 2002. If so, the system is rebooted. The worm also creates a backdoor Trojan. It tries to copy %windir%\CMD.EXE to the following files:
It will allow a remote attacker to take full control of the web server by sending an HTTP GET request to run scripts/root.exe (default execution-enabled directory of the IIS web server) on the infected web server. The worm create a Trojan horse copy of explorer.exe and copies it to C:\ and D:\. The Trojan horse explorer.exe call the real explorer.exe to masks its existence, and create a virtual mapping which exposes the C:\ and D:\ drives. This exploits the "Relative Shell Path" Vulnerability, it will run every time a user logs in. This payload have persistence even after a reboot of the compromised system. Impact Intruders can execute arbitrary commands within the LocalSystem security context on Windows 2000 systems infected with the "Code Red II" worm. Compromised systems may be subject to files being altered or destroyed. Denial-of-service conditions may be created for services relying on altered or destroyed files. Hosts that have been compromised are also at high risk for being party to attacks on other Internet sites. The widespread, automated attack and propagation characteristics of the "Code Red II" may cause bandwidth denial-of-service conditions in isolated portions of the network, particularly near groups of compromised hosts where "Code Red II" is running. Windows NT 4.0 systems and Cisco 600-series DSL routers may experience denial-of-service as a result of the scanning activity of the worm. Vulnerable System
Solutions According to Security Focus, the steps to be taken in recovering from Code Red II are:
There is a tool created by eEye that is able to scan up to 254 IP addresses at once and determine if any are vulnerable to the .ida "Code Red" attack. Download the eEye Retina CodeRed Scanner
here: Before installation of the software, please visit the software manufacturer web-site for more details. Related Links
Source |