2001WormVulnerability exploitation
Code Red worm
19 July 2001
Code Red exploited a buffer overflow in the indexing service of Microsoft's IIS web server, which Microsoft had patched a month earlier in bulletin MS01-033. Infected servers defaced web pages and scanned for more victims, and the worm was also programmed to flood a specific website.
- Victim
- Internet-facing Microsoft IIS web servers
- Sector
- Cross-sector
- Public attribution
- Not publicly attributed; this page makes no attribution.
Impact
CAIDA measured more than 359,000 hosts infected by the second version of the worm in under 14 hours on 19 July 2001.
Root cause
Internet-facing web servers left unpatched for a known, critical vulnerability.
Lessons learned: the controls it teaches
- Patch internet-facing systems first and fast; a fix had been available for weeks.
- Disable unused server features and extensions to shrink the attack surface.
- Monitor for outbound scanning from servers, which signals compromise.