121–130 of 201 posts
Here the Microsoft Security Bulletin: https://technet.microsoft.com/library/security/ms15-034 I think the title is downplaying the severity of the bug. It's a remote code execution vulnerability in http.sys which is a webserver component running inside the kernel (yea right, great idea!) so you can get remote root via HTTP request. The blog quotes this correctly but I get the feeling the author didn't communicate it…
[deleted]
Earlier quoted context omitted.
Samba doesn't run as a kernel module though. I suspect such a patch would not get far, just as many ridiculed the TUX web server some fifteen years ago.
no, but cifs does; https://www.kernel.org/doc/readme/Documentation-filesystems-...
Best I could do on a freshly installed Win2k12 with IIS was: curl -v http://server-name/iis-85.png -H "Range: bytes=18-18446744073709551615" Run the curl twice and the bluescreen happens the second time. If I don't request the image then it doesn't work. I've not added any specific rules for output caching. Edit: The crash screen is very dull: http://imgur.com/MZ7VNHQ
Could you show the event log entry also?
Best I could do on a freshly installed Win2k12 with IIS was: curl -v http://server-name/iis-85.png -H "Range: bytes=18-18446744073709551615" Run the curl twice and the bluescreen happens the second time. If I don't request the image then it doesn't work. I've not added any specific rules for output caching. Edit: The crash screen is very dull: http://imgur.com/MZ7VNHQ
Best I could do on a freshly installed Win2k12 with IIS was: curl -v http://server-name/iis-85.png -H "Range: bytes=18-18446744073709551615" Run the curl twice and the bluescreen happens the second time. If I don't request the image then it doesn't work. I've not added any specific rules for output caching. Edit: The crash screen is very dull: http://imgur.com/MZ7VNHQ
> Edit: The crash screen is very dull: Could you show the event log entry also?
Best I could do on a freshly installed Win2k12 with IIS was: curl -v http://server-name/iis-85.png -H "Range: bytes=18-18446744073709551615" Run the curl twice and the bluescreen happens the second time. If I don't request the image then it doesn't work. I've not added any specific rules for output caching. Edit: The crash screen is very dull: http://imgur.com/MZ7VNHQ
I can also confirm it crashes my command window using curl via cygwin lol.
I tried to send the bad curl request to our servers (test env, obviously) and I didn't get any error. It seems I should be getting "Requested Range Not Satisfiable" if the server is vulnerable and "The request has an invalid header name" if it's patched. I'm getting neither, simply a normal response HTTP 200 with the requested page. Anyone knows how to really test it? EDIT : It is indeed related to "Output Cache" set…
As all our servers are behind a traffic manager product like F5/ZXTM I'm experimenting with removing the range header so it never reaches the webserver as some app's rely on kernel mode caching to achieve performance. Also my tests seem to indicate that just having kernel mode caching enabled even if you dont have any rules still seem to cause a BSOD.
This is pretty wild.
Earlier quoted context omitted.
I have tried this with kernel caching enabled. (kernel caching IS enabled by default from what I can see). Still unable to reproduce using curl.
Even if you have Kernel Caching enabled (as it is by default) if you haven't created any rule for it you're safe. I created a rule to cache all .png files and I changed the curl request to request a .png image on the server. I got a BSOD!
Earlier quoted context omitted.
I can confirm what Khao is saying from my own testing.
Do you happen to have a screenshot of the BSOD, or could test it a second time to take a screenshot? I don't really have a free test server that I can crash anymore since I tested this morning when not a lot of people were at the office yet.
Earlier quoted context omitted.
According to microsoft's bulletin disabling kernel caching will avoid the vulnerability. * I should cite this : https://technet.microsoft.com/library/security/ms15-034 See section Vulnerability Information > Workarounds
I get the HTTP 416 on windows 8.1 + iis 8.5 unpatched even after turning kernel caching off and restarting iis. Even after rebooting.