Block CodeRed on PIX

[vcolla]

Is there any way to block Code Red worm on PIX just as it can be done on Cisco IOS?

[ciscomoderator]

There are a number of Code Red work resources posted at http://www.cisco.com/warp/public/63/codered_index.shtml that you should find useful. I have also learned of another document that will be published shortly that discusses (among other things) the ability of stateful packet filter firewalls (i.e. Cisco PIX Firewall) to help block the adverse affects of the two versions of the worm.

In the meantime, please carefully review the documents at http://www.cisco.com/warp/public/63/codered_index.shtml and http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bulletin/MS01-033.asp

I will post again to this thread when that document is published.

Thank you for posting your question to the forum.

[ciscomoderator]

Here is another recently published document regarding the Code Red worm worth reading.

http://www.cisco.com/warp/public/cc/so/cuso/epso/sqfr/scdam_wp.htm

[rstaaf]

The PIX can only block by port or IP address so I don't see how you would block it without blocking access to port 80 completely.

[vcolla]

My point exactly. I know I can do it on Cisco IOS with class-maps, but how do I do it on PIX?