191–200 of 201 posts
From the exploit code: memset(&serv_addr, '0', sizeof(serv_addr)); That doesn't seem to be correct. The digit character 0 is not the same as the null character ('\0'). Just write 0 or use `struct sockaddr_in serv_addr = { 0 };`.
ASCII NUL is indeed 0x0. http://en.m.wikipedia.org/wiki/Null_character http://www.bibase.com/images/ascii.gif
Earlier quoted context omitted.
To be fair, http://en.wikipedia.org/wiki/TUX_web_server . Having said that, this is huge. This is way worse than Heartbleed for the IIS crowd.
It really isn't. OpenSSL's heartbleed was incredibly hard to patch because of the sheer number of products that link to the OpenSSL libraries. It required painstaking effort to ensure everything was running the latest releases. And the severity of Heartbleed was such that all encrypted information could be deciphered. Whereas this problem... is a simple server crash that can be fixed by running a Windows Update. Not…
https://gist.github.com/Zagrophyte/ea086087e6fd7ca579ef (Powershell)
https://gist.github.com/Zagrophyte/0fa7a8e2e507fac2b59d (C#)
Earlier quoted context omitted.
I just crashed a 2008 R2 server without a rule, just with "Enable Kernel Caching". Not sure if it is relevant, but I first added a rule for .png, and then removed it again. Still worked.
Site to check: https://lab.xpaw.me/MS15-034
The subject line says HTTP only. Does this attack work over HTTPS?
Earlier quoted context omitted.
Yup, that's not that special though. All major OS have the TCP/IP stack in the kernel. And many (but not all) OS have at least parts of their GUI stacks in the kernel.
MS actually moved the GUI stack into the kernel around NT 4. Used to be (so legend has it) if the video driver crashed on earlier versions of NT, you could restart it, and the system didn't go down. But, you know, PERFORMANCE!!1. Win.
I bet somewhere in the source there is a line which looks like: if (inclusiveEnd + 1 > size) { return ERR_INVALID; } HTTP ranges are inclusive, and most likely implemented here with unsigned 64 bit integers. My guess is the author converted to exclusive range, then compared with size, as a form of validation. It passes the check, because 18446744073709551615 + 1 results in wraparound to 0. The general solution is ins…