PT-2015-2009 · Microsoft · Asp.Net+1

Published 2015-09-08 · Updated 2018-10-12 · CVE-2015-2526

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 4.5 through 4.6

Description The issue is related to errors in the code of the Microsoft .NET Framework, which can be exploited by a remote attacker to cause a denial of service condition on an ASP.NET web site. This is achieved by sending specially crafted requests to the ASP.NET server, leading to significant performance degradation. The vulnerability can be used to disrupt the availability of sites that use ASP.NET.

Recommendations For Microsoft .NET Framework versions 4.5 through 4.6, consider applying configuration changes to handle specially crafted requests properly, or restrict access to the ASP.NET server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-17

Related Identifiers

BDU:2015-11355

CVE-2015-2526

Affected Products

.Net Framework

Asp.Net

References · 9

• https://bdu.fstec.ru/vul/2015-11355 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-101 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2526 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-2526 · Security Note
• http://securitytracker.com/id/1033493 · Note
• http://technet.microsoft.com/security/bulletin/ms15-101 · Note
• http://securityfocus.com/bid/76567 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2526 · Note
• http://technet.microsoft.com/security/bulletin/MS15-101 · Note