6 ms·

Here the Microsoft Security Bulletin: https://technet.microsoft.com/library/security/ms15-034 https://technet.microsoft.com/library/security/ms15-034 I think t

• Mojah 12y ago
  It'll be the second, I'm afraid. Only Windows Servers running IIS should be vulnerable, maybe the post didn't make that entirely clear.
  • detaro 12y ago
    According to comments in the other discussion here about this it might not IIS be only, because that kernel component is used for other HTTP services as well: https://news.ycombinator.com/item?id=9378449 https://news.ycombinator.com/item?id=9378449
    • jsmeaton 12y ago
      Yes, but the user/server would have to be running a web server for it to be hit. Usually, that's IIS. But not every windows machine runs a web server.
      • userbinator 12y ago
        Nor is every machine's port 80 publicly reachable. Everyone behind a NAT won't be, for example (unless they've explicitly forwarded the port for the purposes of running such a server.)
      • MichaelGG 12y ago
        Nope. WinRM or Power shell seem to use it too. Enabled by default. (Just created a 2012R2 server last night.) Plus if you have reservations created with HTTP.SYS, your app doesn't even have to be running. A friend tried turning off IIS, but port 80 would still respond.
• 0942v8653 12y ago
  Sounds like the author understands the bug but does not understand why it allows remote code execution (which I don't understand either; once details are released it should be clarified).
  • bontoJR 12y ago
    That's a good point, because in the example we can clearly see how to check if a system is or not patched and that, using this attack, we can crash a Windows Server. The remote execution part is completely missing (fortunately), but I was wondering if this gives the admin rights on machine (I have absolutely no experience on Windows Server machines, so I don't know how it works in terms of services, permissions and roles).
    • Mojah 12y ago
      It would allow the same privileges as the user which is running IIS, usually a "system" account - which equals Administrative privileges.
      • noselasd 12y ago
        IIS has several components. One of them, the vulnerable part here, is running in kernel space. In kernel space you have access to everything. As far as I know, IIS is the only(bar embedded devices running a single address space OS and various ancient/obsolete toys servers on linux) used in production that handles part of HTTP in kernel space (or ring 0 if you will).
      • eis 12y ago
        You two seem to not understand still, please re-read my comment. The point is this is allowing code execution within the kernel of windows. It doesn't even reach the IIS userland process.
        • reidrac 12y ago
          My windows knowledge is rusty and outdated but... do you mean that code runs in ring 0? that "kernel space"?
• pjmlp 12y ago
  > webserver component running inside the kernel (yea right, great idea!) Actually an idea shared among many OS, including GNU/Linux. http://en.wikipedia.org/wiki/In-kernel_web_server http://en.wikipedia.org/wiki/In-kernel_web_server
  • icebraining 12y ago
    Well, of course you can make such a web server on any OS where you can modify or extend the kernel, but TUX is not exactly a popular or recommended solution. There's a reason the reference manual is dated 2001.
    • pjmlp 12y ago
      I fully agree that the idea doesn't make sense, specially when coupled with memory unsafe languages. Just wanted to make the point it isn't a Windows specific idea.
      • zokier 12y ago
        Deploying this sort of thing in production on the other hand seems to be a Windows specific idea.
        • tracker1 12y ago
          IIS is marketted by MS as a VERY capable web server... typically out-performing other web servers by a large margin. The caching system for IIS has always been one of their crowning achievements, working better than most systems. Though, these days most will put a caching server(or cluster) in front of their operations servers. Just the same, it has worked pretty well. Though I predict this feature will be removed, or disabled by default in future versions. I'm kind of surprised this issue wasn't discovered previously. Fortunately, there doesn't seem to be an exploit beyond crashing the server yet (which is bad enough). (sigh, kind of glad I'm in the process of migrating everything away from IIS).
    • yuhong 12y ago
• IgorPartola 12y ago
  To be fair, http://en.wikipedia.org/wiki/TUX_web_server http://en.wikipedia.org/wiki/TUX_web_server. Having said that, this is huge. This is way worse than Heartbleed for the IIS crowd.
  • psibi 12y ago
    From the linked page: "TUX has never been an integrated part of the official Linux kernel, although it has been shipped in some distributions, notably Red Hat, SuSE and Fedora."
    • IgorPartola 12y ago
      Sure. My point is that Microsoft isn't the entity to put a web server (or at least components of one) in the kernel. Some may look at it and laugh about how silly that idea is, but in reality many have tried it.
      • na85 12y ago
        Yep. Another reason folks are against systemd, as it also includes a baked-in http server. Systemd is also poised to become a veritable "second kernel" on linux systems and nobody seems to care enough to stop it.
        • psibi 12y ago
          Isn't systemd an user space process ?
          • na85 12y ago
            Yes. It's still on track to becoming a second kernel.
            • 4ydx 12y ago
              I agree that systemd is a bad idea in the sense that they are doing too much all at once. It is a fine level of arrogance to assume that there wont be problems along the way :P That being said this thread is about the poor souls who are running IIS servers.
• deleted 12y ago
  [deleted]
• easytiger 12y ago
  > http.sys which is a webserver component running inside the kernel (yea right, great idea!) I had no idea. Madness
  • kstrauser 12y ago
    > I had no idea. Madness They aren't the only ones who do this: https://www.freebsd.org/cgi/man.cgi?accf_http https://www.freebsd.org/cgi/man.cgi?accf_http . All sorts of things are kernel-accelerated on modern operating systems, including lots of network operations. From that perspective, this is just one more and it could potentially have a huge benefit (like the same page served count on fewer hardware) for customers who need it. Obviously it's critically important that MS get this right if they're going to offer it at all, but that's pretty much a tautology when talking about kernels and core OS functionality. Judge them on a bad implementation, not on any inherent badness in the idea.
    • floatboth 12y ago
      You haven't read the manpage, have you? The idea is completely different. accf_http is... here, just read the source: https://github.com/freebsd/freebsd/blob/master/sys/netinet/accf_http.c https://github.com/freebsd/freebsd/blob/master/sys/netinet/a... – if it sees something that looks like an HTTP request and delays returning to userspace until \r\n\r\n. http.sys is an actual HTTP/1.x parser. That runs in ring 0.
  • jameshart 12y ago
    Why is it inherently 'madness' to have part of your HTTP stack running in kernel space? I think it's generally accepted that handling TCP in the kernel isn't madness; what's the magic distinction between dealing with TCP packets from remote machines and dealing with HTTP requests from remote machines that makes one of them an acceptable activity to carry out in kernel space, and one not? To be clear about http.sys, it's not what you would normally consider a 'web server'. It leaves things like 'serving files' and 'authentication' and stuff up to userland application processes like IIS. But it allows multiple userland applications to be routed HTTP requests directly, without an IPC dispatch.
• deleted 12y ago
  [deleted]
  • amaks 12y ago
    Presumably the original idea was IIS performance.
    • thegeomaster 12y ago
      Yeah, I completely missed that in order for kernel caching to work, HTTP has to be parsed within the kernel, and so I was making an invalid point. It happens.