https://wiki.sarg.dev/index.php?action=history&feed=atom&title=Code_Red_IICode Red II - Revision history2026-10-13T21:17:31ZRevision history for this page on the wikiMediaWiki 1.44.2https://wiki.sarg.dev/index.php?title=Code_Red_II&diff=292999&oldid=previmported>Wot611: add CVE ID2024-12-29T16:19:23Z<p>add CVE ID</p>
<p><b>New page</b></p><div>{{short description|Computer worm}}<br />
{{ infobox computer virus<br />
| Fullname = Code Red II<br />
| Common name = <br />
| Technical name =<br />
| Aliases = <br />
| Family =<br />
| Classification =<br />
| Type = Server Jamming Worm<br />
| Subtype =<br />
| IsolationDate =<br />
| Origin =<br />
| Author =<br />
| Ports used =<br />
| OSes = <br />
| Filesize =<br />
| Language = <br />
}}<br />
'''Code Red II''' is a [[computer worm]] similar to the [[Code Red worm]]. Released two weeks after Code Red on August 4, 2001, it is similar in behavior to the original, but analysis showed it to be a new worm instead of a variant. Unlike the first, the second has no function for attack; instead it has a backdoor that allows attacks. The worm was designed to [[Vulnerability (computing)|exploit a security hole]] in the indexing software included as part of Microsoft's [[Internet Information Server]] (IIS) web server software (CVE-2001-0500).<br />
<br />
A typical signature of the Code Red II worm appears in a web server log as:<br />
<br />
GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX<br />
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX<br />
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX<br />
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX<br />
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX<br />
%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801<br />
%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3<br />
%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0<br />
<br />
While the original worm tried to infect other computers at random, Code Red II tries to infect machines on the same subnet as the infected machine.<br />
<br />
Microsoft had released a security patch for IIS on June 18, 2001, that fixed the security hole,<ref>{{cite web | url=http://www.microsoft.com/technet/security/bulletin/MS01-033.mspx | title=Microsoft Security Bulletin MS01-033 | author=Microsoft | date=2001-06-18 | work=Microsoft TechNet | accessdate=2007-02-08}}</ref> however not everyone had patched their servers, including Microsoft themselves.<ref>{{cite web | url=http://www.pcworld.com/article/id,57584-page,1/article.html | title=Microsoft Sees Red: Worm Infects Its Own Servers | author=Joris Evers | date=2001-08-09 | work=IDG News Service | accessdate=2007-02-08 | archive-url=https://web.archive.org/web/20070427010621/http://www.pcworld.com/article/id,57584-page,1/article.html | archive-date=2007-04-27 | url-status=dead }}</ref><br />
<br />
==See also==<br />
<br />
*[[Nimda]]<br />
*[[Timeline of computer viruses and worms]]<br />
<br />
==References==<br />
{{reflist}}<br />
<br />
==External links==<br />
* [https://web.archive.org/web/20191213105201/http://www.unixwiz.net/techtips/CodeRedII.html Original Analysis of Code Red II] - analysis by Steve Friedl<br />
* [https://web.archive.org/web/20041205102928/http://eeye.com/html/research/advisories/AL20010804.html ANALYSIS: CodeRed II Worm] - analysis by eEye Digital Security<br />
* [http://www.sans.org/reading_room/whitepapers/malicious/code-red-code-red-ii-double-dragons_88]<br />
<br />
[[Category:Exploit-based worms]]<br />
[[Category:Hacking in the 2000s]]</div>imported>Wot611