[Xitami] RE: Bigtime Newbie

[Paul Reid]

> After zillions of these probes I do not find root.exe anywhere on any of my systems.  

Good. You should NOT have root.exe. It is really CMD (NT's
improved COMMAND.COM) moved by the virus to where a hacker can
access it. 

> Is there some reason to believe that Code Red can infiltrate my system even thru Xitami?

CodeRed targets a very specific set of bugs in MS IIS server and
the indexing service that goes with NT. If you send a very large
request to IIS, it will over-write memory that isn't supposed to
be used to store the request ("buffer overrun"). Apparently the
memory it overwrites is program code that can be subverted by
overwriting it with the hacker's code. Now the hacker has a way
to run software on the victim machine. 

Xitami appears to not have the buffer overrun problem (maybe
because it was written by smart suspicious people instead of the
kids at Microsoft). And even if it did, the memory "beyond" the
buffer is not the susceptible code found in IIS Indexing. Even if
it were program code, it would not be the same code as IIS, so a
bug written for IIS would not infect, just die.

If you wonder if you may be susceptible (it is possible to have
IIS running without knowing it) go to eEye's site
http://www.eeye.com/html/Research/Tools/codered.html and download
the scanner. You need to know your IP number; you can scan up to
255 IP numbers in one pass. A tip: use the "Show All Servers"
option so you know what non-IIS servers are on your network. I
found a PWS server downstairs that the owner didn't know about.
PWS is a cut-down IIS, but apparently not vulnerable. 

 -PRR