{"data":{"case":{"actions":{"de":["Installiere auf Servern mit IIS 4.0 oder 5.0 Microsofts kumulativen Patch **MS01-044** oder ein späteres Update, etwa das **Windows 2000 Service Pack 3**. Das schließt alle IIS-Lücken, die Nimda ausnutzte.","Aktualisiere den **Internet Explorer 5.01 oder 5.5** mit dem Patch aus **MS01-020** oder einem späteren kumulativen Patch oder steige auf IE 6 um. So können E-Mails Anhänge nicht mehr von selbst starten. Installiere IE 6 unter Windows 95, 98 und ME als typische oder vollständige Installation.","Betrachte den Computer als übernommen, wenn du Folgendes findest: eine Datei **root.exe** auf einem IIS-Server, eine **Admin.dll** im obersten Ordner von Laufwerk C:, D: oder E: oder unerwartete .eml- oder .nws-Dateien in vielen Ordnern. Formatiere dann das Systemlaufwerk und installiere das System von vertrauenswürdigen Medien neu.","Blockiere eingehenden Webverkehr auf **Port 80** zu Computern, die keine Webserver sein sollen. Sperre **TFTP (UDP-Port 69)** am Übergang deines Netzwerks zum Internet. Halte Computer, auf denen noch Windows NT 4.0 oder Windows 2000 läuft, vom offenen Internet fern."],"en":["On servers with IIS 4.0 or 5.0, install Microsoft's cumulative patch **MS01-044** or a later update, such as **Windows 2000 Service Pack 3**. This closes every IIS flaw that Nimda used.","Update **Internet Explorer 5.01 or 5.5** with the fix from **MS01-020** or a later cumulative patch, or move to IE 6. That way, e-mails can no longer start attachments on their own. On Windows 95, 98 and ME, install IE 6 with the Typical or Full option.","Treat the computer as taken over if you find a **root.exe** file on an IIS server, an **Admin.dll** in the top folder of drive C:, D: or E:, or unexpected .eml or .nws files in many folders. Then format the system drive and reinstall from trusted media.","Block incoming web traffic on **port 80** to computers that are not meant to be web servers. Block **TFTP (UDP port 69)** at the edge of your network. Keep computers that still run Windows NT 4.0 or Windows 2000 off the open internet."]},"criteria":{"damage":{"de":"Die einzige Gesamtzahl, eine Schätzung von Computer Economics, liegt bei 635 Millionen US-Dollar und damit unter der Schwelle. CERT/CC erhielt Meldungen über Ausfälle durch Überlastung (Denial of Service), doch die Quellen belegen keine Ausfälle kritischer Dienste (Computer Economics; CERT/CC).","en":"The only total is an estimate of USD 635 million by Computer Economics, below the threshold. CERT/CC received reports of denial of service, but the sources document no outage of critical services (Computer Economics; CERT/CC).","met":false},"exploitation":{"de":"Nimda war ein Wurm: Jeder infizierte Computer suchte nach IIS-Servern und infizierte sie von selbst. Binnen 12 Stunden versuchten 450.000 Internetadressen, ihn weiterzuverbreiten (CERT/CC; CAIDA).","en":"Nimda was a worm: every infected computer searched for IIS servers and infected them on its own. Within 12 hours, 450,000 internet addresses tried to spread it (CERT/CC; CAIDA).","met":true},"reach":{"de":"CAIDA zählte am 18. September 2001 auf dem Höhepunkt 160.000 infizierte Computer. Microsofts Webserver-Software lief in diesem Monat auf 27,46 % aller Websites (CAIDA; Netcraft).","en":"CAIDA counted 160,000 infected computers at the peak on September 18, 2001. That month, Microsoft's web server software ran 27.46 % of all websites (CAIDA; Netcraft).","met":true},"response":{"de":"Microsofts Patches waren seit mindestens vier Monaten verfügbar. Darüber hinaus belegen die Quellen nur Internetanbieter, die infizierte Kunden vom Netz nahmen oder den Webverkehr blockierten, sowie ein Hilfsprogramm von Microsoft (CAIDA; Microsoft).","en":"Microsoft's fixes had been out for at least four months. Beyond them, the sources document only internet providers that cut off infected customers or blocked web traffic, and a support program by Microsoft (CAIDA; Microsoft).","met":false}},"cves":["CVE-2001-0333","CVE-2000-0884","CVE-2001-0154"],"cvss":7.5,"cvss_version":"2.0","cwe":"NVD-CWE-Other","dates":[{"date":"2000-10-17","de":"Microsoft warnt vor der älteren IIS-Lücke; ein Patch vom August 2000 schließt sie bereits (MS00-078)","en":"Microsoft warns of the older IIS flaw; a patch from August 2000 already fixes it (MS00-078)"},{"date":"2001-03-29","de":"Microsoft schließt die Lücke im Internet Explorer, die E-Mail-Anhänge von selbst ausführt (MS01-020)","en":"Microsoft fixes the Internet Explorer flaw that runs e-mail attachments on its own (MS01-020)"},{"date":"2001-05-14","key":"patched"},{"date":"2001-08-04","de":"CodeRedII beginnt, sich zu verbreiten, und hinterlässt Hintertüren auf IIS-Servern","en":"CodeRedII begins to spread and leaves backdoors on IIS servers"},{"date":"2001-08-15","de":"Der kumulative Patch MS01-044 enthält die Fixes für alle IIS-Lücken, die Nimda später ausnutzt","en":"Cumulative patch MS01-044 contains the fixes for all IIS flaws that Nimda later uses"},{"date":"2001-09-18","key":"outbreak"},{"date":"2001-09-18","key":"peak"}],"de":{"credit":"NSFocus meldete Microsoft die Hauptlücke","fixed":"MS01-026 (14. Mai 2001) für die Hauptlücke; alle IIS-Lücken im kumulativen Patch MS01-044 (15. August 2001); die Lücke im Internet Explorer in MS01-020 (29. März 2001)","product":"Microsoft-IIS-Webserver und Windows-Computer mit Internet Explorer 5.01 oder 5.5","summary":"Ein Wurm griff Microsofts Webserver und Windows-PCs auf fünf Wegen zugleich an, von E-Mails bis zu Hintertüren von CodeRedII. In sieben Stunden infizierte er 160.000 Computer."},"disclosed":"2001-09-18","en":{"credit":"NSFocus reported the main flaw to Microsoft","fixed":"MS01-026 (May 14, 2001) for the main flaw; all IIS flaws in the cumulative patch MS01-044 (August 15, 2001); the Internet Explorer flaw in MS01-020 (March 29, 2001)","product":"Microsoft IIS web servers, and Windows computers with Internet Explorer 5.01 or 5.5","summary":"A worm attacked Microsoft's web servers and Windows PCs by five routes at once, from e-mail to backdoors left by CodeRedII. It infected 160,000 computers within seven hours."},"figures":[{"de":"Computer auf dem Höhepunkt infiziert, 7 Stunden nach Beginn des Ausbruchs","en":"computers infected at the peak, 7 hours after the outbreak began","value":"160,000"},{"de":"Tage zwischen Microsofts Patch für die Hauptlücke und dem Ausbruch","en":"days between Microsoft's fix for the main flaw and the outbreak","value":"127"},{"de":"Internetadressen versuchten in den ersten 12 Stunden, den Wurm zu verbreiten","en":"internet addresses tried to spread the worm within the first 12 hours","value":"450,000"},{"de":"aller Websites liefen mit Microsofts Webserver-Software, die der Wurm angriff","en":"of all websites ran on Microsoft's web server software, which the worm attacked","value":"27 %"}],"key":"nimda","name":"Nimda","product":"Microsoft IIS, Internet Explorer","sources":[{"de":"CERT/CC-Warnung CA-2001-26: Nimda Worm (in der SEI-Sammlung der Warnungen von 2001, PDF)","title":"CERT/CC advisory CA-2001-26: Nimda Worm (in the SEI collection of 2001 advisories, PDF)","url":"https://www.sei.cmu.edu/documents/508/2001_019_001_496192.pdf"},{"de":"CAIDA: Dynamic Graphs of Nimda, die Ausbreitung am 18. und 19. September 2001","title":"CAIDA: Dynamic Graphs of Nimda, the spread on September 18 and 19, 2001","url":"https://www-old.caida.org/dynamic/analysis/security/nimda/"},{"de":"How to 0wn the Internet in Your Spare Time, USENIX Security Symposium (2002), mit Messungen zu Nimda am LBNL","title":"How to 0wn the Internet in Your Spare Time, USENIX Security Symposium (2002), with measurements of Nimda at LBNL","url":"https://www.icir.org/vern/papers/cdc-usenix-sec02/"},{"de":"Netcraft Web Server Survey vom Oktober 2001, mit den Zahlen vom September (Kopie auf LWN.net)","title":"Netcraft Web Server Survey of October 2001, with the September figures (copy on LWN.net)","url":"https://static.lwn.net/2001/1108/a/netcraft1001.php3"},{"de":"Microsoft-Sicherheitsbulletin MS01-026: kumulativer Patch für IIS mit dem Fix für die Hauptlücke","title":"Microsoft security bulletin MS01-026: cumulative patch for IIS with the fix for the main flaw","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-026"},{"de":"Microsoft-Sicherheitsbulletin MS00-078: Web Server Folder Traversal","title":"Microsoft security bulletin MS00-078: Web Server Folder Traversal","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2000/ms00-078"},{"de":"Microsoft-Sicherheitsbulletin MS01-020: Internet Explorer führt E-Mail-Anhänge aus","title":"Microsoft security bulletin MS01-020: Internet Explorer runs e-mail attachments","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-020"},{"de":"Microsoft-Sicherheitsbulletin MS01-044: kumulativer Patch für IIS vom 15. August 2001","title":"Microsoft security bulletin MS01-044: cumulative patch for IIS of August 15, 2001","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-044"},{"de":"NVD: CVE-2001-0333","title":"NVD: CVE-2001-0333","url":"https://nvd.nist.gov/vuln/detail/CVE-2001-0333"},{"de":"NVD: CVE-2000-0884","title":"NVD: CVE-2000-0884","url":"https://nvd.nist.gov/vuln/detail/CVE-2000-0884"},{"de":"NVD: CVE-2001-0154","title":"NVD: CVE-2001-0154","url":"https://nvd.nist.gov/vuln/detail/CVE-2001-0154"},{"de":"CAIDA: Archiv zu Code-Red, mit CodeRedII","title":"CAIDA: Code-Red archive, with CodeRedII","url":"https://www.caida.org/archive/code-red/"},{"de":"Computer Economics (heute Teil von Avasant): wirtschaftliche Folgen von Schadcode im Jahr 2001, eine Schätzung","title":"Computer Economics (now part of Avasant): economic impact of malicious code in 2001, an estimate","url":"https://avasant.com/?p=250739"},{"de":"Microsoft: Strategic Technology Protection Program (3. Oktober 2001)","title":"Microsoft: Strategic Technology Protection Program (October 3, 2001)","url":"https://news.microsoft.com/source/2001/10/03/microsoft-aligns-company-resources-to-ensure-secure-customer-networks/"},{"de":"Microsoft Security Blog: 20 Jahre Trustworthy Computing, über Code Red und Nimda (2022)","title":"Microsoft Security Blog: 20 years of Trustworthy Computing, on Code Red and Nimda (2022)","url":"https://www.microsoft.com/en-us/security/blog/2022/01/21/celebrating-20-years-of-trustworthy-computing/"}],"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","year":2001}},"description":"In September 2001, the Nimda worm spread by e-mail, infected websites and attacks on web servers at once. Within 7 hours, 160,000 computers were infected.","language":"en","latest_measurement":"2026-11-01","method":"latency-v3","method_page":"https://crackthe.net/data/method/","source":"https://crackthe.net/","text":"On September 18, 2001, shortly before 12:00 UTC, a worm called Nimda began to spread around the world. Seven hours later, 160,000 computers were infected, according to the internet research center CAIDA. A worm is a program that copies itself from one computer to the next on its own. Nimda used five routes at once: e-mail, infected websites, shared network folders, two flaws in IIS, Microsoft\u0026rsquo;s web server software, and backdoors left by CodeRedII. That worm had used the same flaw as Code Red. Microsoft had fixed every flaw Nimda used months before.\nHow it worked The CERT Coordination Center (CERT/CC), a US center for security incidents, described the worm on the day of the outbreak. Nimda arrived by e-mail as an attachment called readme.exe, labeled as a sound file. Mail programs such as Outlook Express use Internet Explorer to display e-mails written in HTML, the language of web pages. In Internet Explorer 5.01 and 5.5, a flaw made the browser run such a mislabeled attachment on its own. Just seeing the message in the preview pane was enough. Microsoft had fixed this flaw on March 29, 2001.\nOnce running, Nimda mailed itself to the addresses it found on the computer, and again every 10 days. Every infected computer, including ordinary desktop PCs, also searched the internet for IIS servers. Half of the addresses it tried shared the first two of the four numbers of its own address. So the worm favored its own neighborhood. Once one e-mail had passed a company\u0026rsquo;s firewall, the machines behind it were likely targets.\nOn each server, Nimda first looked for the backdoors of CodeRedII and of an older worm called sadmind/IIS. Then it tried two directory traversal flaws. A web server should only hand out files from its web folder. It should block requests that contain “..”, which means “one folder up”. IIS could be fooled by writing these characters in an unusual form. In the older flaw, they were written with special Unicode characters. In the newer one, they were encoded twice, because IIS decoded the request a second time after its security check. This let the worm run commands on the server and make it download a copy of the worm.\nOn a server it had taken over, Nimda added a short JavaScript program to every web page. Visitors with an unpatched Internet Explorer could then be infected just by viewing the page. It also copied itself into every folder it could write to, including shared network folders. It shared the C: drive and created a Guest account with administrator rights.\nE-mailreadme.exe runs as soon as the message is previewed Infected PCsearches for IIS servers, preferring nearby ones IIS servera traversal flaw or an old backdoor lets the worm in Visitorthe infected web page passes the worm on Each infected computer also e-mailed the worm on and copied it to shared folders. Where Internet Explorer lacked the fix, viewing a message or a web page was enough. Reach and damage Nimda had a large target: in the survey of the firm Netcraft for September 2001, Microsoft\u0026rsquo;s web server software ran 27.46 % of all websites, 8,895,343 sites. Only Apache ran more.\nCAIDA, at the University of California San Diego, counted the computers it saw spreading Nimda in steps of 15 minutes. The infection peaked around 19:00 UTC with 160,000 infected computers. By midnight UTC, CAIDA had seen 450,000 different internet addresses trying to spread the worm. An address is not always one computer, so this is not an exact count of machines.\nNimda as counted by CAIDA, September 18, 2001 Computers infected at the peak, 7 hours in160,000 Internet addresses that tried to spread the worm within 12 hours450,000 The second bar counts internet addresses, not computers, over the whole first 12 hours. Source: CAIDA.\nResearchers at the Lawrence Berkeley National Laboratory, a US research lab, measured the probes for IIS servers. Within half an hour, they rose from almost none to nearly 100 per second.\nThe worm\u0026rsquo;s traffic did harm of its own. CERT/CC received reports of denial of service caused by the scanning and the e-mails. According to CAIDA, some networks were so flooded by their own infected machines that their links to the internet were saturated. The firm Computer Economics estimated the worldwide economic impact of Nimda at USD 635 million, less than a quarter of its estimate for Code Red. This is an estimate, not a measurement. The sources document no outage of critical services such as hospitals or power supplies.\nThe fix and the response When Nimda appeared, all its flaws were known. Microsoft warned of the older IIS flaw on October 17, 2000, and a patch from August 2000 already fixed it. The fix for Internet Explorer followed on March 29, 2001. The fix for the newer IIS flaw came on May 14, 2001, 127 days before the outbreak. On August 15, 2001, Microsoft released MS01-044, a cumulative patch that contained all these IIS fixes. Servers infected by CodeRedII in August kept its backdoor unless they had been cleaned up.\nFor infected servers, CERT/CC gave blunt advice: “The only safe way to recover from the system compromise is to format the system drive(s) and reinstall the system software from trusted media.” Nimda had changed web pages and programs and created a new account, so removing the worm was not enough.\nInfected machines also fell silent faster than after Code Red. Less than 24 hours after Nimda began to infect large numbers of computers, half of the infected machines no longer spread it. After Code Red and CodeRedII, this had taken 11 days. According to CAIDA, part of the reason was that machines were cut off rather than cleaned. Organizations disconnected themselves, and internet providers cut off infected customers or blocked web traffic.\nTime until half of the infected machines stopped spreading the worm Nimda, less than a day24 h Code Red and CodeRedII, 11 days264 h Hours until half of the infected machines no longer sent out the worm. Source: CAIDA.\nNimda did not disappear. In the months after the outbreak, the Berkeley lab confirmed attacks from 63,000 different Nimda hosts. Its researchers note that this may be an undercount, because they only counted the attacks on web servers.\nTwo weeks after the outbreak, Microsoft announced an “unprecedented mobilization” of its staff, with free virus-related support and a tool to lock down IIS. The announcement does not name Nimda. Microsoft later wrote that Code Red and Nimda led some customers to rethink their use of IIS.\nWhich flaw counts as the main one Nimda used three flaws with a CVE number: two in IIS, one in Internet Explorer. Here, the newer IIS flaw, CVE-2001-0333, counts as the main one. Through it, every infected computer attacked web servers without help from anyone. It also worked on more servers than the older one. Microsoft\u0026rsquo;s fix for it contained the older fix, but Windows 2000 Service Pack 2 contained only the older one. No measurement shows how many computers each route infected. The National Vulnerability Database rates all three flaws 7.5 out of 10 on CVSS 2.0, so the choice does not change the score.","title":"Nimda: the worm that infected 160,000 computers in 7 hours","url":"https://crackthe.net/security/vulnerabilities/nimda/"}