CodeRed wormcatcher found on the net

From: Martin Markgraf (mm@rien-ag.de)
Date: 08/24/01


Message-Id: <200108241105.NAA07083@home.rienag.de>
Subject: CodeRed wormcatcher found on the net
To: vuln-dev@securityfocus.com
Date: Fri, 24 Aug 2001 13:05:28 +0200 (CEST)
From: Martin Markgraf <mm@rien-ag.de>



Hello,

Attached you will find a interesting perl program I found
on the net. It's some kind of "wormcatcher" for the CR II
and I havn't seen it mentioned on the list befor.
It reads the local webserver logfile and if it find an
CR II attempt it tries to execute several commands on
the offending server.

regards,
  Martin

-- 
Martin Markgraf
Rien Informationssysteme AG                         fon: +49 2841 9083061
Eurotec-Ring 15                                     fax: +49 2841 9083069
D-47445 Moers            http://www.rien-ag.de          mm@rien-ag.de




Relevant Pages

  • Re: CodeRed wormcatcher found on the net
    ... CodeRed wormcatcher found on the net ... On Fri, 24 Aug 2001, Martin Markgraf wrote: ... > Attached you will find a interesting perl program I found on the net. ... Strike One. ...
    (Vuln-Dev)
  • Re: CodeRed wormcatcher found on the net
    ... CodeRed wormcatcher found on the net ... Martin Markgraf wrote: ... >Attached you will find a interesting perl program I found ... >the offending server. ...
    (Vuln-Dev)
  • Re: CodeRed wormcatcher found on the net
    ... CodeRed wormcatcher found on the net ... programs and spoof an attack. ... >>the offending server. ...
    (Vuln-Dev)