Tool released to scan for possible CodeRed infected servers

From: Marc Maiffret (marc@EEYE.COM)
Date: 07/21/01

Message-ID:  <>
Date:         Fri, 20 Jul 2001 16:27:58 -0700
From: Marc Maiffret <marc@EEYE.COM>
Subject:      Tool released to scan for possible CodeRed infected servers

In an effort to help administrators find all systems within their network
that are vulnerable to the .ida buffer overflow attack, which the "Code Red"
worm is using to spread itself, we have decided to release a free tool named
CodeRed Scanner. It can scan a range of IP addresses and report back any IP
addresses which are vulnerable to the .ida attack, and susceptible to the
"Code Red" worm.

The program will allow you to either scan a single IP address or a Class C
(254) set of IP addresses. It will output a list of IP addresses which can
be double clicked on to get information on how to patch your system from the
.ida vulnerability and to eradicate the "Code Red" worm from your system.
Also this is a program you get to install on your own computer so you do not
have to go to a website and register to scan 1 IP address at a time etc...
like some of the other scanners we have seen that scan for the CodeRed Worm.

We are able to remotely scan IP addresses (web servers) for the .ida
vulnerability (CodeRed Worm) without having to test your system via a buffer
overflow, which can bring your web server down. Instead we use a technique
which we have taken from Retina that allows CodeRed Scanner the ability to
test a web server remotely, without causing any harm to it. This allows us
to see if the .ida patch is installed or not (if the server is infected or
susceptible to infection).

To download CodeRed Scanner go to:

Marc Maiffret
Chief Hacking Officer
eEye Digital Security
F.949.349.9538 - Network Security Scanner - Network Traffic Analyzer - Stop known and unknown IIS vulnerabilities

Delivery co-sponsored by Trend Micro
If you would like to know about a virus outbreak before CNN and ZDNet get
Trend Micro Virus Info Feed FREE. Simply copy and paste a small piece of
code to give your visitors a real-time top 10 list and the latest virus
advisories. Setup takes just 10 minutes and requires no server-side code on
your Web site. All content is updated automatically from Trend Micro's Web

Relevant Pages

  • SecurityFocus Microsoft Newsletter #76
    ... MICROSOFT VULNERABILITY SUMMARY ... Working Resources BadBlue Cross Site Scripting Vulnerability ... Microsoft Commerce Server 2000 ISAPI Buffer Overflow Vulnerability ... Essentia Web Server Long URL Denial Of Service Vulnerability ...
  • SecurityFocus Microsoft Newsletter #95
    ... MICROSOFT VULNERABILITY SUMMARY ... BEA Systems WebLogic Server and Express Race Condition Denial... ... Key Focus KF Web Server Directory Contents Disclosure... ... KMMail Code Injection Vulnerability ...
  • SecurityFocus Microsoft Newsletter #142
    ... MICROSOFT VULNERABILITY SUMMARY ... Mollensoft Enceladus Server Suite Clear Text Password Storage... ... FakeBO Syslog Format String Vulnerability ... Methodus 3 Web Server File Disclosure Vulnerability ...
  • SecurityFocus Microsoft Newsletter #139
    ... OFF any Windows 2000 Managed Dedicated Hosting Solution from Interland. ... Sun ONE Application Server Plaintext Password Vulnerability ... Batalla Naval Remote Buffer Overflow Vulnerability ...
  • SecurityFocus Microsoft Newsletter #140
    ... Cafelog b2 Remote File Include Vulnerability ... Webfroot Shoutbox Remote Command Execution Vulnerability ... Pablo Software Solutions Baby POP3 Server Multiple Connection... ... Microsoft Windows XP Nested Directory Denial of Service... ...