North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

RE: Code Red 2 cleanup; reporting..

  • From: Mark Radabaugh - Amplex
  • Date: Sun Aug 12 12:59:30 2001 
Interestingly enough it seems Microsoft's patch creates a DOS against
IIS servers that redirect requests:
http://www.incidents.org/diary/diary.php#801

We were seeing IIS crash on a CodeRed patched NT box over the last few
weeks.  It turns out to be caused by the combination of CodeRed and
Microsoft's patch.  Changing the redirect behavior of the server seems
to have fixed it.  Given the way IIS crashes I wouldn't be too surprised
to find out that there is another buffer overrun somewhere in either the
patch or the redirect code.

Mark Radabaugh
Amplex
(419) 833-3635