ID: IRCNE2012011375
Date: 2012-01-11
According to “ComputerWorld”, exploit code for a recently patched denial-of-service vulnerability that affects Microsoft's ASP.NET Web development platform has been published online, therefore increasing the risk of potential attacks.
The vulnerability, identified as CVE-2011-3414, was disclosed in December at the Chaos Communication Congress, Europe's largest and oldest hacker conference. Shortly afterward, Microsoft published a security advisory and released an out-of-band patch for the flaw.
The type of attack facilitated by this vulnerability affects other Web application platforms as well and each of them has its own mitigation instructions.
"This vulnerability could allow an anonymous attacker to efficiently consume all CPU resources on a web server, or even on a cluster of web servers," explained Suha Can and Jonathan Ness, two Microsoft Security Response Center (MSRC) engineers, in a blog post back in December.
"For ASP.NET in particular, a single specially crafted ~100kb HTTP request can consume 100% of one CPU core for between 90 -- 110 seconds. An attacker could potentially repeatedly issue such requests, causing performance to degrade significantly enough to cause a denial of service condition for even multi-core servers or clusters of servers," they said.
On Friday, a user who calls himself HybrisDisaster, published a proof-of-concept (PoC) exploit for the ASP.NET vulnerability on GitHub, a platform that hosts open source development projects.
Related Links:
Microsoft patches dangerous web flaw
- 4