Code Red 2 cleanup; reporting..

Sun Aug 12 16:56:56 UTC 2001

Interestingly enough it seems Microsoft's patch creates a DOS against
IIS servers that redirect requests:
http://www.incidents.org/diary/diary.php#801

We were seeing IIS crash on a CodeRed patched NT box over the last few
weeks.  It turns out to be caused by the combination of CodeRed and
Microsoft's patch.  Changing the redirect behavior of the server seems
to have fixed it.  Given the way IIS crashes I wouldn't be too surprised
to find out that there is another buffer overrun somewhere in either the
patch or the redirect code.

Mark Radabaugh
Amplex
(419) 833-3635