3 ms·
AFAIK a working crash has been released but not the code to actually exploit it.
by Pwntastic 11y ago
AFAIK a working crash has been released but not the code to actually exploit it.
- drzaiusapelord 11y agoAh, thanks I just saw this elsewhere. Looks like anyone with curl can BSOD an unpatched IIS server. Wow, this is pretty bad. I patched last night when I saw this in the news. Scary stuff.
- quotedmycode 11y agoAh, but it's not IIS, this is something less than IIS called HTTP.sys which is used by SSRS in sql 2008 or 2012. It's also used by some other windows services, so chances are you wouldn't even know you are running http.sys unless your software specifically mentioned it.