HTTP.sys Range Header RCE (MS15-034)

aka MS15-034

Product: Microsoft Windows HTTP.sys / IIS
CVE: CVE-2015-1635
Disclosed: 2015-04-14
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: Windows 7, 8, 8.1, Server 2008 R2, Server 2012 and 2012 R2 (any service using HTTP.sys, notably IIS).
Fixed: MS15-034 (KB3042553).

Summary

An integer overflow in the kernel-mode HTTP driver used by IIS. A single HTTP request with a huge Range header could crash the server or leak kernel memory, and Microsoft rated it as remote code execution.

Root cause

HTTP.sys parses the Range header's upper bound into a 64-bit value and computes the range length without overflow checks. A range ending at 18446744073709551615 (2^64-1) wraps the length calculation, causing out-of-bounds reads from the kernel cache, which shows up as information disclosure or a BSOD.

Impact

Unauthenticated remote kernel memory disclosure and DoS (BSOD), theoretically RCE, against IIS and other HTTP.sys consumers.

Public PoC

# safe check: 416 = vulnerable, 400 = patched
curl -v http://10.0.0.20/ -H "Host: test" \
  -H "Range: bytes=0-18446744073709551615"

# nmap
nmap -p80 --script http-vuln-cve2015-1635 10.0.0.20

Source: Public check (nmap http-vuln-cve2015-1635 / SANS ISC)

Detection

Vulnerable servers answer the test request below with '416 Requested Range Not Satisfiable'; patched servers return 400. nmap script http-vuln-cve2015-1635; nuclei template CVE-2015-1635.

Mitigation

Install MS15-034. Workaround: disable IIS kernel caching (at the cost of performance).