Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Kernel Code Execution Via HTTP Request In IIS On Windows

ma.ttias.be

Post reply on HN
Print view View original

71–80 of 201 posts

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#73

Post by guiomie »

Khao wrote: post #29

I tried to send the bad curl request to our servers (test env, obviously) and I didn't get any error. It seems I should be getting "Requested Range Not Satisfiable" if the server is vulnerable and "The request has an invalid header name" if it's patched. I'm getting neither, simply a normal response HTTP 200 with the requested page. Anyone knows how to really test it? EDIT : It is indeed related to "Output Cache" set…

Are you sure you have IIS on an OS with the vulnerability? It seems like windows 2008 R2 has it, but not 2008. My work is all on windows 2008, not R2.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#75

Post by jimbobimbo »

jobigoud wrote: post #63

Is the HttpListener .NET class impacted? https://msdn.microsoft.com/en-us/library/system.net.httplist...

http.sys lives at the bottom of HTTP processing/consumption stack, and that's where vulnerability is. HttpListener simply uses Windows HTTP stack's services, as IIS and others do.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#76

Post by JohnBooty »

FYI: I believe all you need to do is run Windows Update (and reboot) in order to get the patch for this.

I'm mentioning this because found I the Microsoft articles slightly unclear; they listed separate downloads for these updates and I wasn't sure if those updates were available via Windows Update or not.

However, it appears that running Windows Update is sufficient. I ran Windows Update on a 2008 R2 server running IIS. One of the updates it pulled down was "Security Update for Windows Server 2008 R2 x64 Edition (KB3042553) which is the KB article that references this vulnerability.

After Windows Update & a reboot, I used the curl snippet provided on the linked article to test my patched server. At this point it does not appear to be vulnerable to this issue.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#77

Post by drzaiusapelord »

skillsfirst wrote: post #33

But wait, I thought Micro$oft were lauded as having "got" security these days? Surely it is isn't so!

Lets not play the "my team is better than your team" hysterics, especially when we all had to do emergency patching for shellshock, heartbleed, samba, etc in the past couple months. Hell, sambra runs as root too.

There's a lot of security stupidity out there. I'm still waiting for a unixy OS to be written in something like Rust.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#78

Post by easytiger »

eis wrote: post #4

Here the Microsoft Security Bulletin: https://technet.microsoft.com/library/security/ms15-034 I think the title is downplaying the severity of the bug. It's a remote code execution vulnerability in http.sys which is a webserver component running inside the kernel (yea right, great idea!) so you can get remote root via HTTP request. The blog quotes this correctly but I get the feeling the author didn't communicate it…

> http.sys which is a webserver component running inside the kernel (yea right, great idea!)

I had no idea. Madness

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#79

Post by walls »

higherpurpose wrote: post #32

> Details are withheld for now At least for us. DHS/NSA already has them thanks to Microsoft's renewed commitment to share "cyber-threat" data with them (a.k.a zero-days).

> DHS/NSA already has them

Every major security company has them thanks to MAPP. I don't quite understand why people have such a problem with this program.

You also can't ignore that the most recent linux vulnerabilities were privately disclosed to major vendors weeks ahead of time, as well.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#80

Post by eqkosch »

Khao wrote: post #68
pweissbrod wrote: post #43

Earlier quoted context omitted.

I have tried this with kernel caching enabled. (kernel caching IS enabled by default from what I can see). Still unable to reproduce using curl.

Even if you have Kernel Caching enabled (as it is by default) if you haven't created any rule for it you're safe. I created a rule to cache all .png files and I changed the curl request to request a .png image on the server. I got a BSOD!

Can you please provide example of CURL syntax you used to produce this please?
Post reply on HN