PT-2014-1667 · Microsoft · Asp.Net+1

Published 2014-02-11 · Updated 2018-10-12 · CVE-2014-0253

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 1.1 SP1 through 4.5.1

Description The issue allows remote attackers to cause a denial of service, resulting in an ASP.NET daemon hang, via crafted HTTP requests that trigger persistent resource consumption for a stale or closed connection. This has been exploited in the wild. The problem exists in Microsoft ASP.NET and could allow an attacker to cause an ASP.NET server to become unresponsive.

Recommendations For Microsoft .NET Framework versions 1.1 SP1 through 4.5.1, consider restricting access to the ASP.NET service to minimize the risk of exploitation until a patch is available. As a temporary workaround, consider disabling the ASP.NET daemon to prevent the denial of service condition. Avoid using crafted HTTP requests that could trigger persistent resource consumption for a stale or closed connection until the issue is resolved.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-00601

CVE-2014-0253

Affected Products

.Net Framework

Asp.Net

References · 10

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0253 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-0253 · Security Note
• https://bdu.fstec.ru/vul/2015-00601 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-009 · Vendor Advisory
• http://securityfocus.com/bid/65415 · Note
• http://technet.microsoft.com/en-us/security/bulletin/ms14-009 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0253 · Note
• http://secunia.com/advisories/56793 · Note
• http://securitytracker.com/id/1029745 · Note
• http://osvdb.org/103162 · Note