Can't edit the top comment anymore :( but it has been found that indeed no rules are needed to exploit this (my previous answer is outdated and wrong!)
If you can't afford to reboot your servers right now to install the patch, at least you can add this to your web.config and deploy your websites ASAP :
Instead of updating every single web.config of your website I think it is better to just update once and for all by updating machine.config. What you say ?
Seems like you can't add a system.webServer node on the machine.config, but you could add it to applicationHost.config (source: http://www.iis.net/learn/get-started/planning-your-iis-archi... ) so yes, that would be faster. You have to make sure that none of your web.config files override that setting though!
If you can't afford to reboot your servers right now to install the patch, at least you can add this to your web.config and deploy your websites ASAP :
<configuration> <system.webServer> <caching enableKernelCache="false"/> </system.webServer> </configuration>