21–30 of 201 posts
>A remote code execution vulnerability exists in the HTTP protocol stack [...] could execute arbitrary code in the context of the System account. SYSTEM is higher than admin. Using IIS on windows is like running a webserver as root on linux.
Only at the HTTP parsing stage.. Once you get into ASP.net you'll have dropped privileges.
Here the Microsoft Security Bulletin: https://technet.microsoft.com/library/security/ms15-034 I think the title is downplaying the severity of the bug. It's a remote code execution vulnerability in http.sys which is a webserver component running inside the kernel (yea right, great idea!) so you can get remote root via HTTP request. The blog quotes this correctly but I get the feeling the author didn't communicate it…
> webserver component running inside the kernel (yea right, great idea!) Actually an idea shared among many OS, including GNU/Linux. http://en.wikipedia.org/wiki/In-kernel_web_server
Here the Microsoft Security Bulletin: https://technet.microsoft.com/library/security/ms15-034 I think the title is downplaying the severity of the bug. It's a remote code execution vulnerability in http.sys which is a webserver component running inside the kernel (yea right, great idea!) so you can get remote root via HTTP request. The blog quotes this correctly but I get the feeling the author didn't communicate it…
To be fair, http://en.wikipedia.org/wiki/TUX_web_server . Having said that, this is huge. This is way worse than Heartbleed for the IIS crowd.
Here the Microsoft Security Bulletin: https://technet.microsoft.com/library/security/ms15-034 I think the title is downplaying the severity of the bug. It's a remote code execution vulnerability in http.sys which is a webserver component running inside the kernel (yea right, great idea!) so you can get remote root via HTTP request. The blog quotes this correctly but I get the feeling the author didn't communicate it…
To be fair, http://en.wikipedia.org/wiki/TUX_web_server . Having said that, this is huge. This is way worse than Heartbleed for the IIS crowd.
That's what I thought, none (except maybe the author's blog? wild guess).
Earlier quoted context omitted.
It would allow the same privileges as the user which is running IIS, usually a "system" account - which equals Administrative privileges.
You two seem to not understand still, please re-read my comment. The point is this is allowing code execution within the kernel of windows. It doesn't even reach the IIS userland process.
Here the Microsoft Security Bulletin: https://technet.microsoft.com/library/security/ms15-034 I think the title is downplaying the severity of the bug. It's a remote code execution vulnerability in http.sys which is a webserver component running inside the kernel (yea right, great idea!) so you can get remote root via HTTP request. The blog quotes this correctly but I get the feeling the author didn't communicate it…
> webserver component running inside the kernel (yea right, great idea!) Actually an idea shared among many OS, including GNU/Linux. http://en.wikipedia.org/wiki/In-kernel_web_server
That people actually use it is another topic.
Earlier quoted context omitted.
It would allow the same privileges as the user which is running IIS, usually a "system" account - which equals Administrative privileges.
You two seem to not understand still, please re-read my comment. The point is this is allowing code execution within the kernel of windows. It doesn't even reach the IIS userland process.
From the exploit code: memset(&serv_addr, '0', sizeof(serv_addr)); That doesn't seem to be correct. The digit character 0 is not the same as the null character ('\0'). Just write 0 or use `struct sockaddr_in serv_addr = { 0 };`.
EDIT : It is indeed related to "Output Cache" setting in IIS as I said I was suspecting in another comment. I managed to crash our servers by going to IIS Management, select the website I wanted to test, go to Output Caching, enable the feature AND also add a rule (I added a rule for .png just to test). If you have NO rules it is the same as having the feature disabled so you are safe. If you add a rule and check "Enable Kernal Caching" you are vulnerable!
EDIT 2 : As some have asked, this is the command I used to crash our test server. I tested it after having created a new Output Caching rule to cache all .png files in kernel mode.
curl -v http://example.com/image.png -H "Range: bytes=18-18446744073709551615"
I didn't take a screenshot of the BSOD and I don't plan on crashing our test env a second time today because people are using it (I tested it early enough that not a lot of people were at the office yet).
Earlier quoted context omitted.
That's a good point, because in the example we can clearly see how to check if a system is or not patched and that, using this attack, we can crash a Windows Server. The remote execution part is completely missing (fortunately), but I was wondering if this gives the admin rights on machine (I have absolutely no experience on Windows Server machines, so I don't know how it works in terms of services, permissions and r…
It would allow the same privileges as the user which is running IIS, usually a "system" account - which equals Administrative privileges.
As far as I know, IIS is the only(bar embedded devices running a single address space OS and various ancient/obsolete toys servers on linux) used in production that handles part of HTTP in kernel space (or ring 0 if you will).
