RED CODE and the Cisco 67x Series - May be useful info for others as well...

[MysticLlama]

Posted this in networking as well, but I think it could help some people out so going here for exposure.

Well, we all know that the red code worm is a pain in the ass.

Here in the Seattle area, several people with Qwest DSL are having tremendous problems with their Cisco routers crashing every 2-3 hours.

After doing a lot of research, there seems to be something I've found that works.

Red Code propagates by scanning for web services on random ips. Cisco 67xs and other routers have a web management interface that can be queried by this. After too many such queries the router will crash and hard lock.

What I've discovered (through reading others' discoveries ), is that when you set the web service to disabled on the router, it is not completely disabled. By doing a query of the port, you will get a web page that says access denied. So a page is still getting served, the router is still putting out work for these requests.

To get around this, I changed the port number on the web service to something other than port 80. By default all web attempts go to that port. When the port is changed, instead of throwing up an access denied web page on a request, the request just times out, because the router effectively ignores it. It's still a slight bandwidth hit, but at least it's not crashing the router at this point.

Hope this helps some people out, my router at the office has now been up for almost 20 hours, and my previous record was less than 4.

 

[TunaBoo]

Any signs of code red getting under control?

 

[Maverick]

I have a Cisco 675, how do I change the web server port on it?

 

[MysticLlama]

To change the webserver port login and type the following:

set web port xx

where xx is some port number you make up.

 

[Viper GTS]

You need to be at a cbos# prompt.

To get there, use your management cable & Hyperterminal. Connect directly to whatever serial port you're physically connected to. Port settings are 38.4/no flow control, all other settings are OK at default. Hit enter to get a password prompt. If you have an executive password set, enter it. If not, the default password is null. After that you'll have a cbos> prompt. Type in "en" (short for enable), hit enter. At the password prompt, either enter your enable password or hit enter if you don't have one set. You should be at a cbos#. Enter the command, & then close hyperterminal.

Also, more info (including this).

Viper GTS

 

[thorin]

See this thread from earlier today.

Cisco Code Red Advisory

"As a separate side-effect, the URI used by the worm to infect other hosts causes Cisco 600 series DSL routers to stop forwarding traffic if they have not been upgraded for a previously-published unrelated vulnerability. An affected 600 series router that has been scanned by the "Code Red" worm will not resume normal service until the power has been cycled. "

"The following Cisco products may be vulnerable due to side-effects caused by the "Code Red" worm. They are not directly vulnerable to the Microsoft IIS exploit:
? Cisco 600 series of DSL routers that have not been patched for a previously published vulnerability. "

Thorin