The bug is easy to exploit - you just send the server an overly long request like this: The vulnerability was given the identifier MS01-33. There was a buffer overflow error in the idq.dll library.

The internet worm exploited a trivial vulnerability in one of the web server modules, more specifically an extension for data indexing. Spread of the Code Red worm as of July 19, 2001. According to various sources, more than 300,000 servers were attacked in total. Later, the Center for Applied Internet Data Analysis (CAIDA) unveiled statistics for July 19, which clearly demonstrated the speed of Code Red’s distribution. The malware used already infected systems for further attacks, and in a matter of days it had spread worldwide. However, the relatively early detection did little to halt the epidemic. They named the malware after the first object that caught their blurry eye: a can of Mountain Dew Code Red soda. This was followed by a sleepless night, which they spent poring over the system logs looking for the traces of infection. All of a sudden, their test server stopped responding.

Code Red discoverers were researchers at eEye Security, who at the time of detection (July 13, 2001) just so happened to be developing a system for finding Microsoft IIS vulnerabilities. Its story has a happy beginning at least: the spread of the malware was detected right at the start of the outbreak. Code Red was a worm that targeted Windows-based systems with Microsoft IIS (Internet Information Services for Windows Server) installed.

Sudden attack evolution hack