GSLC · Question #31
Which of the following viruses/worms uses the buffer overflow attack?
The correct answer is A. Code red worm. The Code Red worm exploited a buffer overflow vulnerability in Microsoft IIS to propagate automatically, making it one of the most well-known examples of a worm that uses buffer overflow as its primary attack vector.
Question
Which of the following viruses/worms uses the buffer overflow attack?
Options
- ACode red worm
- BKlez worm
- CNimda virus
- DChernobyl (CIH) virus
How the community answered
(15 responses)- A87% (13)
- B7% (1)
- C7% (1)
Why each option
The Code Red worm exploited a buffer overflow vulnerability in Microsoft IIS to propagate automatically, making it one of the most well-known examples of a worm that uses buffer overflow as its primary attack vector.
Code Red exploited a buffer overflow vulnerability (CVE-2001-0500) in the ISAPI extension of Microsoft Internet Information Services (IIS) 5.0, allowing remote code execution without authentication. By sending a specially crafted HTTP GET request with an overly long URL, it overwrote adjacent memory and executed arbitrary code, then scanned for other vulnerable IIS hosts to replicate itself.
The Klez worm propagated primarily via email attachments and exploited an Outlook/IE MIME header vulnerability (CVE-2001-0154), not a classic buffer overflow.
Nimda spread through multiple vectors including email, network shares, and IIS Unicode directory traversal exploits, but its primary mechanism was not a buffer overflow.
The Chernobyl (CIH) virus is a file-infecting virus that overwrites the hard drive's boot sector and flash BIOS; it does not use buffer overflow techniques.
Concept tested: Buffer overflow exploitation by Code Red worm
Source: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2001/ms01-033
Topics
Community Discussion
No community discussion yet for this question.