Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#1

Post by Mojah » Wed, Apr 15, 2015, 12:28 PM UTC

Remote Kernel Code Execution Via HTTP Request In IIS On Windows
ma.ttias.be

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#2

Post by MichaelGG » Wed, Apr 15, 2015, 12:51 PM UTC

So unchecked arithmetic is the culprit, again? And this would seem to be the kind of thing that could get passed through frontends unless they already cached a result.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#3

Post by __michaelg » Wed, Apr 15, 2015, 12:53 PM UTC

The interesting take-away is the .sys suffix on the filename: Yes, Windows contains a device driver running in Kernel mode that cares about (IIS) HTTP traffic.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#4

Post by eis » Wed, Apr 15, 2015, 12:55 PM UTC

Here the Microsoft Security Bulletin: https://technet.microsoft.com/library/security/ms15-034

I think the title is downplaying the severity of the bug. It's a remote code execution vulnerability in http.sys which is a webserver component running inside the kernel (yea right, great idea!) so you can get remote root via HTTP request. The blog quotes this correctly but I get the feeling the author didn't communicate it properly.

Someone please adjust the title of this submission to something like "CVE-2015-1635: remote kernel code execution via HTTP request affecting Windows Server"

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#5

Post by Mojah » Wed, Apr 15, 2015, 12:58 PM UTC

eis wrote: post #4

Here the Microsoft Security Bulletin: https://technet.microsoft.com/library/security/ms15-034 I think the title is downplaying the severity of the bug. It's a remote code execution vulnerability in http.sys which is a webserver component running inside the kernel (yea right, great idea!) so you can get remote root via HTTP request. The blog quotes this correctly but I get the feeling the author didn't communicate it…

It'll be the second, I'm afraid. Only Windows Servers running IIS should be vulnerable, maybe the post didn't make that entirely clear.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#6

Post by 0942v8653 » Wed, Apr 15, 2015, 12:59 PM UTC

eis wrote: post #4

Here the Microsoft Security Bulletin: https://technet.microsoft.com/library/security/ms15-034 I think the title is downplaying the severity of the bug. It's a remote code execution vulnerability in http.sys which is a webserver component running inside the kernel (yea right, great idea!) so you can get remote root via HTTP request. The blog quotes this correctly but I get the feeling the author didn't communicate it…

Sounds like the author understands the bug but does not understand why it allows remote code execution (which I don't understand either; once details are released it should be clarified).

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#7

Post by kpcyrd » Wed, Apr 15, 2015, 1:02 PM UTC

>A remote code execution vulnerability exists in the HTTP protocol stack [...] could execute arbitrary code in the context of the System account.

SYSTEM is higher than admin. Using IIS on windows is like running a webserver as root on linux.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#8

Post by bontoJR » Wed, Apr 15, 2015, 1:03 PM UTC

0942v8653 wrote: post #6

eis wrote: post #4

Here the Microsoft Security Bulletin: https://technet.microsoft.com/library/security/ms15-034 I think the title is downplaying the severity of the bug. It's a remote code execution vulnerability in http.sys which is a webserver component running inside the kernel (yea right, great idea!) so you can get remote root via HTTP request. The blog quotes this correctly but I get the feeling the author didn't communicate it…

Sounds like the author understands the bug but does not understand why it allows remote code execution (which I don't understand either; once details are released it should be clarified).

That's a good point, because in the example we can clearly see how to check if a system is or not patched and that, using this attack, we can crash a Windows Server.

The remote execution part is completely missing (fortunately), but I was wondering if this gives the admin rights on machine (I have absolutely no experience on Windows Server machines, so I don't know how it works in terms of services, permissions and roles).

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#9

Post by detaro » Wed, Apr 15, 2015, 1:05 PM UTC

Mojah wrote: post #5

eis wrote: post #4

Here the Microsoft Security Bulletin: https://technet.microsoft.com/library/security/ms15-034 I think the title is downplaying the severity of the bug. It's a remote code execution vulnerability in http.sys which is a webserver component running inside the kernel (yea right, great idea!) so you can get remote root via HTTP request. The blog quotes this correctly but I get the feeling the author didn't communicate it…

It'll be the second, I'm afraid. Only Windows Servers running IIS should be vulnerable, maybe the post didn't make that entirely clear.

According to comments in the other discussion here about this it might not IIS be only, because that kernel component is used for other HTTP services as well:

https://news.ycombinator.com/item?id=9378449

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#10

Post by aninteger » Wed, Apr 15, 2015, 1:05 PM UTC

kpcyrd wrote: post #7

>A remote code execution vulnerability exists in the HTTP protocol stack [...] could execute arbitrary code in the context of the System account. SYSTEM is higher than admin. Using IIS on windows is like running a webserver as root on linux.

Only at the HTTP parsing stage.. Once you get into ASP.net you'll have dropped privileges.