[Xitami] Code Red requests

[John Poltorak]

On Tue, Aug 07, 2001 at 09:40:48AM -0500, Craig Morrison wrote:
> 
> John Poltorak wrote:
> > 
> > They said the worm is sent along as part of the GET request, and there is
> > no requirement for a subsequent connection.
> 
> The bulk of the request is made up of the characters causing the buffer
> overflow. It is possible, but I don't see how, considering the damage it can
> do, in the remaining characters it can perform its "magic".
> 
> I've been wrong before, so if I am so be it.
> 
> > 
> > I'm going to do a trace myself to see if I can confirm this.
> 
> I'd be interested in seeing the results. Off the list of course.

Here's some technical analysis of the worm which you may interesting (or 
even scary...) :-


http://www.securityfocus.com/templates/archive.pike?fromthread=0&list=1&threads=0&mid=201886&end=2001-08-11&start=2001-08-05&

I'm glad I don't use Windows.

Apparently IIS is often running without people even knowing...
 
> > 
> > BTW is there any that XITAMI can be configured to perform a specific
> > action depending on a request such "Get /default.ida..." ?
> 
> PHP, REXX or some type of CGI scripting would help here. You'd have to
> associate *.ida documents to the scripting engine.
> 
> > 
> > Or how could create a page which would satisfy this GET request?
> 
> Create a stock HTML document and save it as 'default.ida' in the webroot for
> each domain. Then in defaults.cfg add:
> 
> [MIME]
>     Ida=text/html
> 
> It works here, try it:
> 
>   http://www.2cah.com/default.ida?NNNNNNNNNNNNNNNNNNNNNN

:-)  Very good.

Now, how do you get the remote system to reboot? :-)

> 
> -- 
> 
> Craig Morrison
>   MTS Professional @ http://www.2cah.com/
>   A Win32 Email server that works for _you_.
> EzMTS - A _free_ Win32 EMail Server
>   http://www.ezmts.org/
>   Anonymous FTP at ftp://ftp.ezmts.org

-- 
John