61–70 of 201 posts
The part that makes this really nasty is it doesn't just impact webservers. IIS is highly leveraged by other Microsoft technologies, everything from WSUS to SMTP to Exchange to Sharepoint are affected. In my environment, I estimate that 3/4 of my servers are vulnerable.
https://msdn.microsoft.com/en-us/library/system.net.httplist...
Earlier quoted context omitted.
If you don't have the kernel caching enabled, does this vulnerability still work?
According to microsoft's bulletin disabling kernel caching will avoid the vulnerability. * I should cite this : https://technet.microsoft.com/library/security/ms15-034 See section Vulnerability Information > Workarounds
Earlier quoted context omitted.
That's a good point, because in the example we can clearly see how to check if a system is or not patched and that, using this attack, we can crash a Windows Server. The remote execution part is completely missing (fortunately), but I was wondering if this gives the admin rights on machine (I have absolutely no experience on Windows Server machines, so I don't know how it works in terms of services, permissions and r…
It would allow the same privileges as the user which is running IIS, usually a "system" account - which equals Administrative privileges.
Here the Microsoft Security Bulletin: https://technet.microsoft.com/library/security/ms15-034 I think the title is downplaying the severity of the bug. It's a remote code execution vulnerability in http.sys which is a webserver component running inside the kernel (yea right, great idea!) so you can get remote root via HTTP request. The blog quotes this correctly but I get the feeling the author didn't communicate it…
The patches for the MS Server OSes are at: https://support.microsoft.com/en-us/kb/3042553 It's a little unclear that this was patched as part of last night's Patch Tuesday.
Earlier quoted context omitted.
Yep. I tried curl -v to get all the raw headers line by line and the payload is there, and I also tried in telnet, both return a 200 page. I read the microsoft security bulletin and it says that your IIS server is protected if Kernal Caching is off, maybe that's why our servers are neither blocking the request nor crashing with the request.
I have tried this with kernel caching enabled. (kernel caching IS enabled by default from what I can see). Still unable to reproduce using curl.
I created a rule to cache all .png files and I changed the curl request to request a .png image on the server. I got a BSOD!
The interesting take-away is the .sys suffix on the filename: Yes, Windows contains a device driver running in Kernel mode that cares about (IIS) HTTP traffic.
And a GUI stack (win32k.sys).
The interesting take-away is the .sys suffix on the filename: Yes, Windows contains a device driver running in Kernel mode that cares about (IIS) HTTP traffic.
goodness me yes. It appears to be a kernel-mode http parser: http://www.microsoft.com/technet/prodtechnol/WindowsServer20... is that really the only way MS could make IIS fast enough? See also https://en.wikipedia.org/wiki/TUX_web_server
Yeah... that does nasty things to these server's architecture... "Performance at all costs" eventually strays into taking down the barriers built to protect the system, but at the inevitable cost of slowing things down as things go through the barriers.