{"data":{"case":{"actions":{"de":["Prüfe unter Windows 2000 Server, ob IIS läuft: Es ist standardmäßig installiert, und die Lücke ist auch dann erreichbar, wenn niemand den Indexdienst nutzt.","Installiere Microsofts Patch **MS01-033** (KB Q300972) oder ein späteres Update, das ihn enthält, etwa **Windows 2000 Service Pack 3**.","Wenn du ihn nicht installieren kannst, entferne in IIS die **Skriptzuordnungen für .ida und .idq**.","Halte Server, auf denen noch Windows NT 4.0 oder Windows 2000 läuft, vom offenen Internet fern."],"en":["On Windows 2000 Server, check whether IIS is running: it is installed by default, and the flaw can be reached even if nobody uses the indexing service.","Install Microsoft's fix **MS01-033** (KB Q300972) or a later update that contains it, such as **Windows 2000 Service Pack 3**.","If you cannot install it, remove the **.ida and .idq script mappings** in IIS.","Keep servers that still run Windows NT 4.0 or Windows 2000 off the open internet."]},"criteria":{"damage":{"de":"Die Kosten einschließlich späterer Versionen des Wurms werden auf mehr als 2,6 Milliarden US-Dollar geschätzt (Schätzung von Computer Economics, zitiert von CAIDA).","en":"The cost, including later versions of the worm, is estimated at more than USD 2.6 billion (estimate by Computer Economics, quoted by CAIDA).","met":true},"exploitation":{"de":"Code Red war ein sich selbst verbreitender Wurm: Jeder infizierte Server griff von selbst neue Server an (CAIDA).","en":"Code Red was a self-spreading worm: every infected server attacked new ones on its own (CAIDA).","met":true},"reach":{"de":"Code Red infizierte am 19. Juli 2001 in weniger als 14 Stunden 359.104 Computer (CAIDA).","en":"Code Red infected 359,104 computers in less than 14 hours on July 19, 2001 (CAIDA).","met":true},"response":{"de":"Der Patch von Microsoft war seit dem 18. Juni 2001 verfügbar; die Quellen belegen keine Maßnahmen über das übliche Patchen hinaus (Microsoft, CAIDA).","en":"Microsoft's fix had been out since June 18, 2001; the sources document no measures beyond routine patching (Microsoft, CAIDA).","met":false}},"cves":["CVE-2001-0500"],"cvss":10,"cvss_version":"2.0","cwe":"NVD-CWE-Other","dates":[{"date":"2001-06-18","key":"patched"},{"date":"2001-07-12","key":"exploited"},{"date":"2001-07-19","key":"outbreak"},{"date":"2001-08-01","de":"Code Red verbreitet sich erneut","en":"Code Red starts to spread again"},{"date":"2001-08-04","de":"CodeRedII, ein anderer Wurm, nutzt dieselbe Sicherheitslücke aus","en":"CodeRedII, a different worm, uses the same flaw"}],"de":{"credit":"eEye Digital Security","fixed":"Microsoft-Patch MS01-033 (18. Juni 2001); enthalten im Windows 2000 Service Pack 3","product":"Microsoft-IIS-Webserver","summary":"Ein sich selbst verbreitender Wurm nutzte eine Lücke in Microsofts Webserver-Software IIS aus – einen Monat, nachdem Microsoft den Patch veröffentlicht hatte."},"disclosed":"2001-07-19","en":{"credit":"eEye Digital Security","fixed":"Microsoft patch MS01-033 (June 18, 2001); part of Windows 2000 Service Pack 3","product":"Microsoft IIS web servers","summary":"A self-spreading worm used a flaw in Microsoft's web server software IIS, a month after Microsoft had published the fix."},"figures":[{"de":"Computer in weniger als 14 Stunden infiziert","en":"computers infected in less than 14 hours","value":"359,104"},{"de":"Tage zwischen Microsofts Patch und dem massenhaften Ausbruch","en":"days between Microsoft's fix and the mass outbreak","value":"31"},{"de":"der infizierten Computer waren Rechner von Privatleuten und kleinen Firmen","en":"of the infected computers were home and small-business machines","value":"21 %"}],"key":"code-red","name":"Code Red","product":"Microsoft IIS","sources":[{"de":"CAIDA: Code-Red, eine Fallstudie zu Ausbreitung und Opfern eines Internet-Wurms (2002, PDF)","title":"CAIDA: Code-Red, a case study on the spread and victims of an Internet worm (2002, PDF)","url":"https://www.caida.org/publications/papers/2002/codered/codered.pdf"},{"de":"CAIDA: die Ausbreitung des Code-Red-Wurms (CRv2)","title":"CAIDA: the spread of the Code-Red worm (CRv2)","url":"https://www.caida.org/archive/code-red/coderedv2_analysis/"},{"de":"CAIDA: Archiv zu Code-Red, mit CodeRedII","title":"CAIDA: Code-Red archive, with CodeRedII","url":"https://www.caida.org/archive/code-red/"},{"de":"Microsoft-Sicherheitsbulletin MS01-033","title":"Microsoft security bulletin MS01-033","url":"https://learn.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-033"},{"de":"NVD: CVE-2001-0500","title":"NVD: CVE-2001-0500","url":"https://nvd.nist.gov/vuln/detail/CVE-2001-0500"},{"de":"Inside the Slammer Worm, IEEE Security \u0026 Privacy (2003, PDF), mit Code Red zum Vergleich","title":"Inside the Slammer Worm, IEEE Security \u0026 Privacy (2003, PDF), with Code Red for comparison","url":"https://css.csail.mit.edu/6.566/2018/readings/slammer.pdf"}],"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","year":2001}},"description":"In July 2001, the Code Red worm infected more than 359,000 computers running Microsoft's web server in under 14 hours, a month after the fix came out.","language":"en","latest_measurement":"2026-10-23","method":"latency-v3","method_page":"https://crackthe.net/method/","source":"https://crackthe.net/","text":"On July 19, 2001, a worm called Code Red infected 359,104 computers in less than 14 hours. A worm is a program that copies itself from one computer to the next on its own, without anyone clicking on anything. Code Red used a flaw in IIS, Microsoft\u0026rsquo;s web server software, a month after Microsoft had published a fix for it.\nHow it worked IIS came with an add-on for Microsoft\u0026rsquo;s indexing service, which makes files searchable. This add-on copied part of the requested web address into a memory area of fixed size, called a buffer, without checking the length. A request with a very long address overflowed the buffer, and the extra data could contain program code. The server ran that code before any login check. Because the add-on ran with the highest rights in Windows, the attacker\u0026rsquo;s code took full control of the server.\nWindows 2000 Server installed IIS by default, and the faulty add-on could be reached whenever IIS was running, even if nobody used the indexing service.\nCode Red carried its whole program, about 4 KB, inside a single request. Each infected server sent this request to random internet addresses on port 80, the standard network port for websites, at about 11 attempts per second. The first version, active from July 12, 2001, spread slowly, because every copy tried the same addresses in the same order. The second version, from July 19, picked different addresses on every server and spread far faster. It changed web pages on infected servers to show the words “Hacked by Chinese”. At midnight UTC, it was programmed to stop spreading and to start an attack: from the 20th of each month, it flooded a White House website with traffic.\nInfected serverpicks a random internet address Web requestcarries the whole worm, about 4 KB Indexing add-oncopies the address into a buffer that is too small Next serverruns the worm with full rights and starts over No one had to click anything. Each infected server repeated these steps on its own. Reach and damage The spread was measured by CAIDA, an internet research center at the University of California San Diego. CAIDA records the traffic that arrives at large blocks of internet addresses, which infected servers hit by chance while they searched for new victims. By the end of July 19 (UTC), it had counted 359,104 infected computers by their internet addresses, and it treats this number as a lower bound. At the peak, more than 2,000 computers were infected every minute. A later study that compared Code Red with SQL Slammer gives its doubling time as about 37 minutes: the time in which the number of infected computers doubled.\nInfected computers by country, July 19, 2001 United States157,694 South Korea37,948 China18,141 Taiwan15,124 Canada12,469 United Kingdom11,918 Germany11,762 Australia8,587 Japan8,282 Netherlands7,771 The ten countries with the most infected computers. The United States alone had 43.9 % of them. Source: CAIDA.\nNot only large companies were hit. From the network names of the infected computers, CAIDA estimated that 21 % were home and small-business machines. The worm also reached 136 computers with .mil addresses and 213 with .gov addresses, which belong to the US military and to US government agencies.\nThe cost is harder to pin down. The firm Computer Economics estimated that the epidemic, including later versions of Code Red, cost more than USD 2.6 billion. CAIDA\u0026rsquo;s study quotes this figure; it is an estimate, not a measurement.\nThe fix and the response The security firm eEye Digital Security had reported the flaw to Microsoft. On June 18, 2001, eEye published its findings, and Microsoft released a fix in its security bulletin MS01-033. When the worm appeared, eEye analyzed it on July 13 and gave it its name. A month after the fix, Code Red still found hundreds of thousands of servers without it.\nPatching remained slow after the outbreak. CAIDA checked a daily sample of 10,000 of the computers infected on July 19. Between July 24 and July 31, the share of patched machines grew by an average of only 1.5 percentage points a day.\nOn August 1, Code Red began to spread again. By midnight, about 275,000 internet addresses were spreading the worm, and 29,710 computers were newly infected in the hour after 14:00 UTC alone. Only then did the share of patched machines in CAIDA\u0026rsquo;s sample rise markedly, from 32 % to 64 %.\nOn August 4, a different worm, CodeRedII, began to use the same flaw. It was not a new version of Code Red: it installed a backdoor, a hidden way back into the server, and preferred to attack addresses close to its own.\nBy August 14, the share of patched computers differed by type of network:\nInfected computers patched by August 14, 2001 Names ending in .edu81 % Names ending in .com56 % Names ending in .net51 % Share of the infected computers that had been patched, by the ending of their network name. Names ending in .edu belong to US universities. Source: CAIDA.","title":"Code Red: the worm that infected 359,000 servers within 14 hours","url":"https://crackthe.net/vulnerabilities/code-red/"}