PT-2014-1667 · Microsoft · Asp.Net+1

Publicado 2014-02-11 · Atualizado 2018-10-12 · CVE-2014-0253

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 1.1 SP1 through 4.5.1

Description The issue allows remote attackers to cause a denial of service, resulting in an ASP.NET daemon hang, via crafted HTTP requests that trigger persistent resource consumption for a stale or closed connection. This has been exploited in the wild. The problem exists in Microsoft ASP.NET and could allow an attacker to cause an ASP.NET server to become unresponsive.

Recommendations For Microsoft .NET Framework versions 1.1 SP1 through 4.5.1, consider restricting access to the ASP.NET service to minimize the risk of exploitation until a patch is available. As a temporary workaround, consider disabling the ASP.NET daemon to prevent the denial of service condition. Avoid using crafted HTTP requests that could trigger persistent resource consumption for a stale or closed connection until the issue is resolved.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2015-00601

CVE-2014-0253

Produtos afetados

.Net Framework

Asp.Net

Referências · 10

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0253 · Nota de Segurança
• http://securityfocus.com/bid/65415 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-0253 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-00601 · Nota de Segurança
• http://technet.microsoft.com/en-us/security/bulletin/ms14-009 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0253 · Nota
• http://secunia.com/advisories/56793 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-009 · Aviso do Fabricante
• http://securitytracker.com/id/1029745 · Nota
• http://osvdb.org/103162 · Nota