News for hackers. Stuff that matters.

A comment on Remote Kernel Code Execution Via HTTP Request In IIS On Windows. Parent comment

Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by eqkosch on Wednesday April 15, 2015 @12:30PM (#9382122)
As all our servers are behind a traffic manager product like F5/ZXTM I'm experimenting with removing the range header so it never reaches the webserver as some app's rely on kernel mode caching to achieve performance.

Also my tests seem to indicate that just having kernel mode caching enabled even if you dont have any rules still seem to cause a BSOD.

[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by Khao on Wednesday April 15, 2015 @12:47PM (#9382252)
You're right! Even with no rule having kernal caching enabled will crash it! I think IIS assumes it should cache all static content even when there are no rules specifically for them. Somehow I can't edit my comment anymore but I'll leave this here :

EVEN WITH NO RULES, YOU ARE VULNERABLE! My previous answer has been proven to be wrong!

[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by tracker1 on Wednesday April 15, 2015 @01:09PM (#9382434)
That was my case as well... initialized IIS on a fresh server to test against. (took me a while to figure out that IIS wasn't even setup, since the IIS manager was on the server) ... accidentally crashed my local machine too (forgot to change the localhost to the ip of the server whyn copy/pasting the url from the browser on the server)

This is pretty wild.

[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by lontivero on Wednesday April 15, 2015 @07:30PM (#9384949)
If I understood well, the HTTP request with the Range header is just a way to CHECK for the vulnerability and it is not THE vulnerability.

The vulnerability allows execute code remotly under the Syetem account.

Am I wrong?

[ Parent | on HN ]