News for hackers. Stuff that matters.

A comment on Remote Kernel Code Execution Via HTTP Request In IIS On Windows. Parent comment

Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by nbevans on Wednesday April 15, 2015 @11:48PM (#9385797)
It really isn't.

OpenSSL's heartbleed was incredibly hard to patch because of the sheer number of products that link to the OpenSSL libraries. It required painstaking effort to ensure everything was running the latest releases. And the severity of Heartbleed was such that all encrypted information could be deciphered.

Whereas this problem... is a simple server crash that can be fixed by running a Windows Update. Not even on the same scale of vulnerability.

[ Parent | on HN ]
Re:Remote Kernel Code Execution Via HTTP Request In IIS On W... by endian01 on Thursday April 16, 2015 @08:19AM (#9387390)
I personally worried about the simplicity of the attack. Granted at this stage, its just a DoS, but then take corporate patch cycles into account.. In reality, most aren't going to get patched, at best, for another week or so. Security is still second-fiddle at many companies.
[ Parent | on HN ]