ALERT: Vulnerability in Microsoft HTTP.sys allows denial of service and could allow remote code execution (MS15-034)

A vulnerability in Microsoft HTTP.sys allows denial of service and could allow remote code execution if an attacker sends a specially crafted HTTP request to a vulnerable Windows server. Updates are available from Microsoft that should be applied after appropriate testing.

Exploit code currently exists that allows attackers to crash an unpatched server, although code is not yet publicly available that allows an attacker to remotely execute code on an affected machine. There are reports that widespread attempts to crash servers may be occurring.

Publicly available exploit code for this vulnerability allows attackers to crash an unpatched machine, causing denial of service conditions. There are reports that widespread attempts to crash servers may be occurring. Exploit code that allows an attacker to remotely execute code on an unpatched machine has not yet been reported.

• Patch affected machines as soon as possible after appropriate testing.
• Prioritize Windows web servers that are accessible from the internet, especially if they provide critical services or if they store or process sensitive data.
• Consider disabling IIS kernel caching as a temporary workaround if the security update cannot be applied soon. This workaround is specific to IIS and can cause performance issues. See Enable Kernel Caching (IIS 7) for details.

The HTTP.sys vulnerability can be triggered by sending a specially-crafted HTTP request to an affected system. Successful exploitation of this vulnerability could result in an attacker executing arbitrary code in the context of the System account. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

A Windows computer running Windows 7 or 8 is only likely to be vulnerable if used as a web server. If your computer is a web server that is running Windows, update it by using Windows Update.

In general, the best protection for your devices is this: keep your software and apps up-to-date, do not click suspicious links in email, do not open email attachments unless you are expecting them and trust the person who sent them, and only use secure, trusted networks. For more information, see Spam, Phishing, and Suspicious Email, Instructions for Securing Your Devices and Data, and Use a Secure Internet Connection.

Please contact [email protected].

Sincerely, 
Don Welch, 
University of Michigan Chief Information Security Officer

• Microsoft Security Bulletin MS15-034: Vulnerability in HTTP.sys Could Allow Remote Code Execution
• Vulnerability Summary for CVE-2015-1635 (National Vulnerability Database)
• Remote Code Execution Via HTTP Request In IIS On Windows