Re: new codered worm penetrates content-filtering

[Ryan Russell <ryan () securityfocus com>]

OK, I got a sample of one of the CodeReds from Chris Russel that had the
"GET " in one packet, and the rest in subsequent packets.  They are whole
IP packets, so it's not fragmentation.  The actual worm itself is simply
CodeRed.b.  The only other weird thing I've noted is that the PSH flag is
set on the first two packets from the attacker, after the handshake.  I
don't think that's normal.

                                        Ryan


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com