Remote Kernel Code Execution Via HTTP Request In IIS On Windows

Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by Khao on Wednesday April 15, 2015 @01:23PM (#9382538)

Can't edit the top comment anymore :( but it has been found that indeed no rules are needed to exploit this (my previous answer is outdated and wrong!)

If you can't afford to reboot your servers right now to install the patch, at least you can add this to your web.config and deploy your websites ASAP :

[ Parent | on HN ]

Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by mandeepj on Wednesday April 15, 2015 @02:47PM (#9383194)

Instead of updating every single web.config of your website I think it is better to just update once and for all by updating machine.config. What you say ?

[ Parent | on HN ]

Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by Khao on Wednesday April 15, 2015 @02:54PM (#9383251)

Seems like you can't add a system.webServer node on the machine.config, but you could add it to applicationHost.config (source: http://www.iis.net/learn/get-started/planning-your-iis-archi... ) so yes, that would be faster. You have to make sure that none of your web.config files override that setting though!

[ Parent | on HN ]

Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by JonBons on Wednesday April 15, 2015 @04:19PM (#9383794)

I believe IIS supports locking attributes (source: http://www.iis.net/learn/get-started/planning-for-security/h...) so you should be able to lock at applicationHost.config and restrict further modifications. (I'm testing this now)

EDIT:

It causes a config error when a lock violation occurs which means the site gets an error 500 so its not an ideal fix.

[ Parent | on HN ]