PT-2014-1666 · Microsoft · .Net Framework

Alexander Klink · Publicado 2014-09-09 · Atualizado 2018-10-12 · CVE-2014-4072

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 1.1 SP1 through 4.5.2

Description The issue is related to the improper use of a hash table for request data, allowing remote attackers to cause a denial of service via crafted requests. This can lead to resource consumption and performance degradation. An attacker can exploit this by sending a small number of specially crafted requests to a .NET server, causing significant performance degradation and a denial of service condition.

Recommendations For Microsoft .NET Framework versions 1.1 SP1 through 4.5.2, consider implementing measures to restrict the impact of specially crafted requests on server performance, such as limiting the number of concurrent requests or implementing rate limiting. As a temporary workaround, consider restricting access to sensitive resources until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

BDU:2015-00600

CVE-2014-4072

Produtos afetados

.Net Framework

Referências · 9

• http://blogs.technet.com/b/srd/archive/2014/09/09/assessing-risk-for-the-september-2014-security-updates.aspx · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4072 · Nota de Segurança
• http://securityfocus.com/bid/69603 · Nota
• https://bdu.fstec.ru/vul/2015-00600 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-053 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-4072 · Nota de Segurança
• http://securitytracker.com/id/1030819 · Nota
• http://technet.microsoft.com/en-us/security/bulletin/ms14-053 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4072 · Nota