Products Affected

Intel® PRO/Wireless 2011 LAN Access Point Product Codes:

WEAP2011NA WEAP2011EU WEAP2011EO WEAP2011FR WEAP2011JP WEAP2011AR WEAP2011SG WEAP2011KR

Summary

• Intel PRO/Wireless 2011 LAN Access Points are at risk of being affected by the malicious piece of code named "Code Red" worm. The worm takes advantage of a security hole in Microsoft Internet Information Server* (IIS). Consequently, the worm can also generate large amounts of traffic that can overload network devices with built-in web servers - including routers, switches and wireless LAN access points. As a result, this can then cause a buffer overflow condition and slow or hang the Intel PRO/Wireless LAN Access Point.

• The Code Red worm looks for devices with port 80 open. Intel PRO/Wireless Access Points use port 80 for accessing its built-in web server user interface. Once the worm detects a device with port 80 open, it sends large amounts of long data strings to the device, which in turn can cause buffer overflows causing the access point to slow down or completely hang. There is no permanent damage to the Access Point. Resetting the Access Point will restore operation until the worm once again detects the device.

• Temporarily disable the web server user interface in the Access Point and use the Telnet or console interface until the Code Red worm is eradicated from your network. To disable the web server user interface , access the Access Point via Telnet or the console port. In the System Configuration screen, disable the Web Interface.
• To minimize the spread of the worm, install Microsoft's patch to your ISS servers and desktop systems. Download the patch from: http://support.microsoft.com/kb/300972 ^†.
• To clean the worm from your systems, update your ant-virus software and run on all your systems.
• Intel is currently investigating a permanent remedy. Please visit the Wireless Ethernet LAN website for updated information.

This applies to:

Intel® PRO/Wireless 2011 LAN Access Point