News for hackers. Stuff that matters.

A comment on Remote Kernel Code Execution Via HTTP Request In IIS On Windows. Parent comment

Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by Mojah on Wednesday April 15, 2015 @08:58AM (#9380630)
It'll be the second, I'm afraid. Only Windows Servers running IIS should be vulnerable, maybe the post didn't make that entirely clear.
[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by detaro on Wednesday April 15, 2015 @09:05AM (#9380668)
According to comments in the other discussion here about this it might not IIS be only, because that kernel component is used for other HTTP services as well:

https://news.ycombinator.com/item?id=9378449

[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by jsmeaton on Wednesday April 15, 2015 @09:54AM (#9380944)
Yes, but the user/server would have to be running a web server for it to be hit. Usually, that's IIS. But not every windows machine runs a web server.
[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by MichaelGG on Wednesday April 15, 2015 @10:19AM (#9381098)
Nope. WinRM or Power shell seem to use it too. Enabled by default. (Just created a 2012R2 server last night.)

Plus if you have reservations created with HTTP.SYS, your app doesn't even have to be running. A friend tried turning off IIS, but port 80 would still respond.

[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by userbinator on Wednesday April 15, 2015 @10:17AM (#9381086)
Nor is every machine's port 80 publicly reachable. Everyone behind a NAT won't be, for example (unless they've explicitly forwarded the port for the purposes of running such a server.)
[ Parent | on HN ]