RE: code red---- on system that is already (and has been) patched

In a nutshell, if a 200 reply was logged for a "code red" request, then your server received the request and processed it as a vulnerable system should.

Symantec has a little utility (I don't work for them. Just a happy user.) that will check for the vulnerabiltiy and if found to be vulnerable, look for the worm.

http://www.sarc.com/avcenter/fixcodered.zip

If system is found to be vulnerable, I suggest disconnect, clean (if infected), patch, reboot, check again, and if everything looks good, reconnect.

-----Original Message-----

From: Mike Heitz [mailto:mikeheitz@upshotmail.com] Sent: Monday, March 03, 2003 2:30 PM
To: Sandy Ryan; focus-ms@securityfocus.com Subject: RE: code red---- on system that is already (and has been) patched

I'm not 100% sure Sandy, but when I see Code Red hits (my server is patched, and patched on top of patched...) I see a 404 reply instead of a 200...

mike heitz ** sr it manager ** UPSHOT
312-943-0900 x5190

-----Original Message-----

From: Sandy Ryan [mailto:sryan@seewolf.com] Sent: Monday, March 03, 2003 10:47 AM
To: focus-ms@securityfocus.com
Subject: code red---- on system that is already (and has been) patched

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

well - I doubt that the log is right - because I think the 200 implies

that its not infected - by when my customer sees his report - and path

taken through the site he sees worm.com

here's the log (simplified to get through the moderator)

GET /default.ida

NN----NN%u9090%u6858%ucbd3%u7801...%u9090%u9090%u8190%u00c3%u0003%u8b00%

u531b%u53ff%u0078%u0000%u00=a 200 0 206 4039 266 HTTP/1.0 [you know the

url]- - -

Do you need more help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek