4 ms·

I just crashed a 2008 R2 server without a rule, just with "Enable Kernel Caching". Not sure if it is relevant, but I first added a rule for .png, and then remo

• Khao 11y ago
  Can't edit the top comment anymore :( but it has been found that indeed no rules are needed to exploit this (my previous answer is outdated and wrong!) If you can't afford to reboot your servers right now to install the patch, at least you can add this to your web.config and deploy your websites ASAP : <configuration> <system.webServer> <caching enableKernelCache="false"/> </system.webServer> </configuration>
  • mandeepj 11y ago
    Instead of updating every single web.config of your website I think it is better to just update once and for all by updating machine.config. What you say ?
    • Khao 11y ago
      Seems like you can't add a system.webServer node on the machine.config, but you could add it to applicationHost.config (source: http://www.iis.net/learn/get-started/planning-your-iis-architecture/the-configuration-system-in-iis-7 http://www.iis.net/learn/get-started/planning-your-iis-archi... ) so yes, that would be faster. You have to make sure that none of your web.config files override that setting though!
      • JonBons 11y ago
        I believe IIS supports locking attributes (source: http://www.iis.net/learn/get-started/planning-for-security/how-to-use-locking-in-iis-configuration http://www.iis.net/learn/get-started/planning-for-security/h...) so you should be able to lock at applicationHost.config and restrict further modifications. (I'm testing this now) EDIT: It causes a config error when a lock violation occurs which means the site gets an error 500 so its not an ideal fix.
• el_duderino 11y ago
  Site to check: https://lab.xpaw.me/MS15-034 https://lab.xpaw.me/MS15-034
  • wglb 11y ago
    Sadly, only http is checked; won't work for https-only server.
  • buraksarica 11y ago
    And doesn't check for static content first. Try http://ms15-034.azurewebsites.net/ http://ms15-034.azurewebsites.net/ (disclaimer: my app)