Code Red Worm coverage in System Scanner

[Eng, Audra (ISS San Francisco)]

TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
[EMAIL PROTECTED]  Contact [EMAIL PROTECTED] for help with any problems!
----------------------------------------------------------------------------

The Internet has recently been faced with the threat of a worm, dubbed "Code
Red". The worm exploits a vulnerability in unpatched versions of Microsoft
IIS (Internet Information Server). This vulnerability is detailed in an ISS
Security Alert dated July 30, 2001
(http://xforce.iss.net/alerts/advise89.php). 

COVERAGE OF THIS VULNERABILITY IN SYSTEM SCANNER

This vulnerability is addressed by a check in the System Scanner 4.2 X-Press
Update 3.01 released July 13, 2001.  This XPU includes the check MS01-033
'IIS idq.dll ISAPI extension buffer overflow' which detects if the host
system is vulnerable to the Code Red worm.

The check is included in the Initial-1, Maintenance-1 and IIS policies. The
check will report a vulnerability if the appropriate patch detailed in
Microsoft Security Bulletin MS01-033 has not been applied to IIS 4.0 or 5.0.

Questions, comments, or feedback? 
Please email:
[EMAIL PROTECTED]

Audra Eng
Host Protection Product Manager