Code Red II

Code Red II is a <a href="/facts/Computer_worm/9qKR1Hx5">computer worm</a> similar to the <a href="/facts/Code_Red_worm/FIpF7P8R">Code Red worm</a>. Released two weeks after Code Red on August 4, 2001, it is similar in behavior to the original, but analysis showed it to be a new worm instead of a variant. Unlike the first, the second has no function for attack; instead it has a backdoor that allows attacks. The worm was designed to <a href="/facts/Vulnerability_(computing)/jg0Gr71M">exploit a security hole</a> in the indexing software included as part of Microsoft's <a href="/facts/Internet_Information_Server/nqmfJr3T">Internet Information Server</a> (IIS) web server software (CVE-2001-0500).
A typical signature of the Code Red II worm appears in a web server log as:

 GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
 %u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801
 %u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3
 %u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0

While the original worm tried to infect other computers at random, Code Red II tries to infect machines on the same subnet as the infected machine.
Microsoft had released a security patch for IIS on June 18, 2001, that fixed the security hole, however not everyone had patched their servers, including Microsoft themselves.

Code Red II open-in-new

Code Red II