PT-2014-1666 · Microsoft · .Net Framework

Alexander Klink · Published 2014-09-09 · Updated 2018-10-12 · CVE-2014-4072

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 1.1 SP1 through 4.5.2

Description The issue is related to the improper use of a hash table for request data, allowing remote attackers to cause a denial of service via crafted requests. This can lead to resource consumption and performance degradation. An attacker can exploit this by sending a small number of specially crafted requests to a .NET server, causing significant performance degradation and a denial of service condition.

Recommendations For Microsoft .NET Framework versions 1.1 SP1 through 4.5.2, consider implementing measures to restrict the impact of specially crafted requests on server performance, such as limiting the number of concurrent requests or implementing rate limiting. As a temporary workaround, consider restricting access to sensitive resources until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-00600

CVE-2014-4072

Affected Products

.Net Framework

References · 9

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4072 · Security Note
• https://bdu.fstec.ru/vul/2015-00600 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-053 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-4072 · Security Note
• http://blogs.technet.com/b/srd/archive/2014/09/09/assessing-risk-for-the-september-2014-security-updates.aspx · Note
• http://securityfocus.com/bid/69603 · Note
• http://securitytracker.com/id/1030819 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms14-053 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4072 · Note