Hacker News Reader

Comment by cbrevik | Hacker News Reader

I just crashed a 2008 R2 server without a rule, just with "Enable Kernel Caching". Not sure if it is relevant, but I first added a rule for .png, and then removed it again. Still worked.

View on HN

Can't edit the top comment anymore :( but it has been found that indeed no rules are needed to exploit this (my previous answer is outdated and wrong!)

If you can't afford to reboot your servers right now to install the patch, at least you can add this to your web.config and deploy your websites ASAP :

Instead of updating every single web.config of your website I think it is better to just update once and for all by updating machine.config. What you say ?

Seems like you can't add a system.webServer node on the machine.config, but you could add it to applicationHost.config (source: http://www.iis.net/learn/get-started/planning-your-iis-archi... ) so yes, that would be faster. You have to make sure that none of your web.config files override that setting though!

I believe IIS supports locking attributes (source: http://www.iis.net/learn/get-started/planning-for-security/h...) so you should be able to lock at applicationHost.config and restrict further modifications. (I'm testing this now)

EDIT:

It causes a config error when a lock violation occurs which means the site gets an error 500 so its not an ideal fix.

Site to check: https://lab.xpaw.me/MS15-034

Sadly, only http is checked; won't work for https-only server.

And doesn't check for static content first. Try http://ms15-034.azurewebsites.net/ (disclaimer: my app)

Reply on news.ycombinator.com