Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote Kernel Code Execution Via HTTP Request In IIS On Windows

ma.ttias.be

Post reply on HN
Print view View original

181–190 of 201 posts

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#181

Post by TheLoneWolfling »

jameshart wrote: post #180
easytiger wrote: post #78

Earlier quoted context omitted.

> http.sys which is a webserver component running inside the kernel (yea right, great idea!) I had no idea. Madness

Why is it inherently 'madness' to have part of your HTTP stack running in kernel space? I think it's generally accepted that handling TCP in the kernel isn't madness; what's the magic distinction between dealing with TCP packets from remote machines and dealing with HTTP requests from remote machines that makes one of them an acceptable activity to carry out in kernel space, and one not? To be clear about http.sys, i…

It's the amount of complexity, i.e. the number of things to go wrong.

Handling TCP/IP in the kernel requires substantially less complexity than handling HTTP/TCP/IP.

And even then, there are efforts (GNU Hurd, for instance) to push things like TCP out of the kernel level.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#184

Post by stephengillie »

MichaelGG wrote: post #173
MichaelGG wrote: post #113

Earlier quoted context omitted.

It's not IIS. It's HTTP.SYS. New configs have Powershel remote or WinRM. They use http.Sys and are vulnerable.

Seems I'm wrong. Kernel cache has to be enabled explicitly and Powershell/WinRM don't do that. Whew.

We all dodged a bullet there.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#185

Post by MichaelGG »

stephengillie wrote: post #184
MichaelGG wrote: post #173

Earlier quoted context omitted.

Seems I'm wrong. Kernel cache has to be enabled explicitly and Powershell/WinRM don't do that. Whew.

We all dodged a bullet there.

They really should have made it clear that it's a mitigating factors and that most (some, many?) non-IIS uses wouldn't use kernel caching and thus be OK.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#186

Post by nbevans »

IgorPartola wrote: post #19
eis wrote: post #4

Here the Microsoft Security Bulletin: https://technet.microsoft.com/library/security/ms15-034 I think the title is downplaying the severity of the bug. It's a remote code execution vulnerability in http.sys which is a webserver component running inside the kernel (yea right, great idea!) so you can get remote root via HTTP request. The blog quotes this correctly but I get the feeling the author didn't communicate it…

To be fair, http://en.wikipedia.org/wiki/TUX_web_server . Having said that, this is huge. This is way worse than Heartbleed for the IIS crowd.

It really isn't.

OpenSSL's heartbleed was incredibly hard to patch because of the sheer number of products that link to the OpenSSL libraries. It required painstaking effort to ensure everything was running the latest releases. And the severity of Heartbleed was such that all encrypted information could be deciphered.

Whereas this problem... is a simple server crash that can be fixed by running a Windows Update. Not even on the same scale of vulnerability.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#187

Post by nbevans »

Just to clarify to everyone that this vulnerability has absolutely nothing to do with IIS web server. HTTP.SYS is not part of IIS. HTTP.SYS is the way HTTP/S hosting works on Windows. Any applications may use it, it is an API.

HTTP.SYS is a clever idea as it allows the 80/443 ports to be used by multiple processes, as long as they register unique base URLs. What's not so clever about it is that despite rigorous testing and validation against its codebase, that something like this slipped through. Historically, HTTP.SYS has had a pretty good track record (against all the odds) until this week.

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#188

Post by jenscow »

nbevans wrote: post #187

Just to clarify to everyone that this vulnerability has absolutely nothing to do with IIS web server. HTTP.SYS is not part of IIS. HTTP.SYS is the way HTTP/S hosting works on Windows. Any applications may use it, it is an API. HTTP.SYS is a clever idea as it allows the 80/443 ports to be used by multiple processes, as long as they register unique base URLs. What's not so clever about it is that despite rigorous testi…

So, IIS doesn't use http.sys?

Re: Remote Kernel Code Execution Via HTTP Request In IIS On Windows

#189

Post by nbevans »

jenscow wrote: post #188
nbevans wrote: post #187

Just to clarify to everyone that this vulnerability has absolutely nothing to do with IIS web server. HTTP.SYS is not part of IIS. HTTP.SYS is the way HTTP/S hosting works on Windows. Any applications may use it, it is an API. HTTP.SYS is a clever idea as it allows the 80/443 ports to be used by multiple processes, as long as they register unique base URLs. What's not so clever about it is that despite rigorous testi…

So, IIS doesn't use http.sys?

It does. But this vulnerability is specifically with HTTP.SYS. HTTP.SYS is kind of like a SSL terminator and request router built into the OS.
Post reply on HN