PT-2015-2009 · Microsoft · Asp.Net+1

Publicado 2015-09-08 · Atualizado 2018-10-12 · CVE-2015-2526

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 4.5 through 4.6

Description The issue is related to errors in the code of the Microsoft .NET Framework, which can be exploited by a remote attacker to cause a denial of service condition on an ASP.NET web site. This is achieved by sending specially crafted requests to the ASP.NET server, leading to significant performance degradation. The vulnerability can be used to disrupt the availability of sites that use ASP.NET.

Recommendations For Microsoft .NET Framework versions 4.5 through 4.6, consider applying configuration changes to handle specially crafted requests properly, or restrict access to the ASP.NET server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Enumeração de Fraquezas

CWE-17

Identificadores relacionados

BDU:2015-11355

CVE-2015-2526

Produtos afetados

.Net Framework

Asp.Net

Referências · 9

• http://securitytracker.com/id/1033493 · Nota
• http://technet.microsoft.com/security/bulletin/ms15-101 · Nota
• https://bdu.fstec.ru/vul/2015-11355 · Nota de Segurança
• http://securityfocus.com/bid/76567 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2526 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-101 · Aviso do Fabricante
• http://technet.microsoft.com/security/bulletin/MS15-101 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2526 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2015-2526 · Nota de Segurança