It's not IIS. It's HTTP.SYS. New configs have Powershel remote or WinRM. They us... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		MichaelGG on April 15, 2015 \| parent \| context \| favorite \| on: Remote Kernel Code Execution Via HTTP Request In I... It's not IIS. It's HTTP.SYS. New configs have Powershel remote or WinRM. They use http.Sys and are vulnerable.

MichaelGG on April 15, 2015 [–]

Seems I'm wrong. Kernel cache has to be enabled explicitly and Powershell/WinRM don't do that. Whew.

stephengillie on April 16, 2015 | [–]

We all dodged a bullet there.

MichaelGG on April 16, 2015 | | [–]

They really should have made it clear that it's a mitigating factors and that most (some, many?) non-IIS uses wouldn't use kernel caching and thus be OK.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact