Train From Home with Top Cybersecurity Experts, Hands On Labs and 4 Months Access to Content - OnDemand


To attend this webcast, login to your SANS Account or create your Account.

Special Webcast: Microsoft Patch MS15-034

  • Thursday, April 16th, 2015 at 6:00 PM EDT (22:00:00 UTC)
  • Dr. Johannes Ullrich
This webcast has been archived. You can view the webcast presentation and download the slides by logging into your SANS Portal Account or creating an Account. Click the Register Now button after you have logged in to view the Webcast.

You can now attend the webcast using your mobile device!


On Tuesday, April 14 - Microsoft released MS15-034 as part of its monthly patch. The bulletin addresses a vulnerability in HTTP.sys, the library processing HTTP requests in Windows. According to Microsoft, the vulnerability could be used to run arbitrary code on a vulnerable host.

Among other programs, IIS uses HTTP.sys, and is directly exposed to the exploit. As of yesterday, trivial to execute exploits have been made public that will cause an IIS server to crash, and in a published analysis of the bug, an exploit to leak kernel memory was outlined.

We will briefly discuss the exploit, why it happened, how to prevent exploitation and how prevalent its use has already become. Trigger warning:

Do not attend if you dont want to see IIS server squirm and Windows systems blue screen.

Speaker Bio

Johannes Ullrich, PhD

As chief research officer for the SANS Institute, Johannes is currently responsible for the SANS Internet Storm Center (ISC) and the GIAC Gold program. He founded in 2000, which is now the data collection engine behind the ISC. His work with the ISC has been widely recognized, and in 2004, Network World named him one of the 50 most powerful people in the networking industry. Prior to working for SANS, Johannes worked as a lead support engineer for a Web development company and as a research physicist. Johannes holds a PhD in Physics from SUNY Albany and is located in Jacksonville, Florida. He also enjoys blogging about application security tips.

Need Help? Visit our FAQ page or email

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.