Probably it is, because it runs on the IIS.

Code red  infects Windows NT/2000 systems running IIS 4.0 or 5.0. Whether or
not Sharepoint is installed makes no difference.
www.nipc.gov/warnings/alerts/2001/01-016.htm
http://www.digitalisland.net/codered/

SPS itself isn't vulnerable. ...but by implication, the underlying
Windows 2000 server  would be (because it is running IIS).

Just install the following hot fix to remove the threat for your server:

www.microsoft.com/.../itsol" target="_blank" rel="nofollow">www.microsoft.com/.../itsol
utions/security/topics/codealrt.asp

and monitor http://www.microsoft.com/security/ for general information.

For specific security bulletins, goto
www.microsoft.com/.../itsol" target="_blank" rel="nofollow">www.microsoft.com/.../itsol
utions/security/current.asp