PT-2006-2373 · Microsoft · Asp.Net

Debasis Mohanty · Published 2006-03-23 · Updated 2018-10-18 · CVE-2006-1364

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Microsoft w3wp (affected versions not specified)

Description The issue arises from improper handling of COM components in ASP.NET when the AspCompat directive is not used. This allows remote attackers to cause a denial of service by repeatedly requesting specific documents, leading to resource consumption or a crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2006-1364

Affected Products

Asp.Net

References · 11

• 🔥 http://securiteam.com/windowsntfocus/5KP0O0KI0Y.html · Exploit
• 🔥 https://exploit-db.com/exploits/1601 · Exploit
• 🔥 http://securityfocus.com/bid/17188 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-1364 · Security Note
• http://securitytracker.com/id?1015825 · Note
• http://hackingspirits.com/vuln-rnd/w3wp-remote-dos.zip · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1364 · Note
• http://securityfocus.com/archive/1/428622/100/0/threaded · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044292.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/25392 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-March/044291.html · Note