Re: Tool released to scan for possible CodeRed infected servers

From: H C (keydet89at_private)
Date: Mon Jul 23 2001 - 07:15:30 PDT

  • Next message: Aidan O'Kelly: "RE: A very dangerous mail..."

    If you do a packet capture via snort or tcpdump while
    running the tool, you'll see that it's pretty
    straigthforward porting the tool to Perl.  Using
    LWP::UserAgent, the resulting script will run on
    Linux, Unix, NT/2K, even Win95 with no trouble.
    
    Carv
    
    --- tom ring <tar@real-time.com> wrote:
    > Thanks for your efforts.
    > 
    > Will there be a unix source version available?  I
    > won't bother to explain why I'd rather 
    > have that.
    > 
    > tom
    > 
    > On 20 Jul 2001, at 16:27, Marc Maiffret wrote:
    > 
    > > In an effort to help administrators find all
    > systems within their network
    > > that are vulnerable to the .ida buffer overflow
    > attack, which the "Code Red"
    > > worm is using to spread itself, we have decided to
    > release a free tool named
    > > CodeRed Scanner. It can scan a range of IP
    > addresses and report back any IP
    > > addresses which are vulnerable to the .ida attack,
    > and susceptible to the
    > > "Code Red" worm.
    > 
    > 
    > ------
    > Tom Ring WA2PHW  EN34
    > tar@real-time.com
    > 
    > "It is better to go into a turn slow, and come out
    > fast, than to go into a turn fast and come out
    dead."
    
    
    __________________________________________________
    Do You Yahoo!?
    Make international calls for as low as $.04/minute with Yahoo! Messenger
    http://phonecard.yahoo.com/
    



    This archive was generated by hypermail 2b30 : Mon Jul 23 2001 - 09:48:35 PDT