[Xitami-Dev] Weird stuff

[Paul Reid]

> Anyone recognise what this might be? I'm getting about 6 or 7 log entries - with corresponding errors - daily. 

Repeat of my post from yesterday, for people who missed it:

> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN.....

Someone discovered that if you send MS IIS webserver a VERY long packet,
the end of the packet over-writes part of the webserver code. 

The "NNNN..." is just filler. The gibberish at the end is the worm. It
corrupts part of IIS and loads the Code Red worm. See: 

   http://www.cert.org/advisories/CA-2001-23.html

There are patches for IIS that close this backdoor. 

Other webservers (including Xitami) correctly reply "Bad request" and
don't get infected. The attack is very specific to un-patched IIS
servers. It relies on both a buffer overflow and specific locations in
program memory. Even if a webserver had the buffer overflow, on non-IIS
servers the subroutines Code Red infects are not the same, nor in the
same places. 

 -PRR