41–50 of 201 posts
Earlier quoted context omitted.
And how much internet-facing web content is served with this toy webserver exactly? That's what I thought, none (except maybe the author's blog? wild guess).
[deleted]
I tried to send the bad curl request to our servers (test env, obviously) and I didn't get any error. It seems I should be getting "Requested Range Not Satisfiable" if the server is vulnerable and "The request has an invalid header name" if it's patched. I'm getting neither, simply a normal response HTTP 200 with the requested page. Anyone knows how to really test it? EDIT : It is indeed related to "Output Cache" set…
Earlier quoted context omitted.
Are you sure that curl is sending the request properly? (Check with tcpdump)
Yep. I tried curl -v to get all the raw headers line by line and the payload is there, and I also tried in telnet, both return a 200 page. I read the microsoft security bulletin and it says that your IIS server is protected if Kernal Caching is off, maybe that's why our servers are neither blocking the request nor crashing with the request.
> Details are withheld for now At least for us. DHS/NSA already has them thanks to Microsoft's renewed commitment to share "cyber-threat" data with them (a.k.a zero-days).
I suggest: Long-range
> Enable kernel caching to effectively scale and improve Web server performance. Cached responses are served from the kernel. This greatly improves response times and increases the number of requests per second that IIS can serve because requests for cached content never enter IIS user mode.
[1] https://technet.microsoft.com/en-us/library/cc731903(v=ws.10...
The reason the kernel is involved with http handling is a feature called "Kernel Caching"[1]: > Enable kernel caching to effectively scale and improve Web server performance. Cached responses are served from the kernel. This greatly improves response times and increases the number of requests per second that IIS can serve because requests for cached content never enter IIS user mode. [1] https://technet.microsoft.com…
Just taking a guess here, but the code execution probably requires a POST request instead of GET. Nevertheless, it's still quite puzzling how something like this could occur.
Note: I have not tested this personally. Others here https://news.ycombinator.com/item?id=9380889 say they haven't been able to reproduce it.
Edit: apparently you need kernel caching of HTTP requests enabled, and at least one rule for caching, and the request has to satisfy that rule, in order to cause a crash.
The reason the kernel is involved with http handling is a feature called "Kernel Caching"[1]: > Enable kernel caching to effectively scale and improve Web server performance. Cached responses are served from the kernel. This greatly improves response times and increases the number of requests per second that IIS can serve because requests for cached content never enter IIS user mode. [1] https://technet.microsoft.com…
If you don't have the kernel caching enabled, does this vulnerability still work?
* I should cite this : https://technet.microsoft.com/library/security/ms15-034
See section Vulnerability Information > Workarounds