Microsoft scrambles to address widespread ASP.NET bug

Share this article:

Microsoft on Wednesday warned of an unpatched, but publicly known, vulnerability affecting ASP.NET, a web application framework that allows developers to build enterprise-grade web applications.

The flaw affects all versions of the .NET Framework, but so far Microsoft is not aware of any in-the-wild attacks, Dave Forstrom, director of Microsoft Trustworthy Computing, said in a blog post. However, the software giant anticipates exploit code to quickly be developed, and security experts said an emergency fix could come as early as this week.

What makes the bug particularly worrisome is that it enables attackers to use limited means to launch a devastating denial-of-service (DoS) attack against web servers. According to Microsoft, "a single, specially crafted ~100kb HTTP request can consume 100 percent of one CPU core for between 90 to 110 seconds."

"The vulnerability could allow an anonymous attacker to efficiently consume all CPU resources on a web server, or even a cluster of web servers [rendering ASP.NET pages]," Microsoft engineers Suha Can and Jonathan Ness wrote in a blog post. "An attacker could potentially repeatedly issue such requests, causing performance to degrade significantly enough to cause a denial-of-service condition for even multi-core servers or clusters of servers."

Andrew Storms, director of security operations at vulnerability management firm nCircle, said this type of DoS attack is highly unusual.

"This isn't your average DoS attack because it doesn't take a botnet or a lot of coordination to take a web server down," he said. "Most DoS attacks rely on a huge number of small requests targeted at a specific web server to overwhelm it."

The vulnerability is caused by an error in the way ASP.NET handles values in an ASP.NET form post to cause a "hash collision," which happens when two unique pieces of data have the same hash values.

In an advisory, Microsoft has released workaround details. In addition, the company has provided its Active Protections Program (MAPP) partners with detection guidance.

Storms said the issue is not unique to ASP.NET.

"It's highly likely that this attack isn't (Microsoft) specific and probably affects a number of vendors, and we can expect other vendors to make similar zero-day announcements," he said. "Everybody will be scrambling to come up with mitigation advice and patch strategies."


Share this article:

Sign up to our newsletters

More in News

Report: UK police push for required mobile phone PWs

The Metropolitan Police have reportedly lobbied for two years to enact the standard.

JPMorgan Chase customers targeted in massive phishing campaign

JPMorgan Chase customers targeted in massive phishing campaign

Roughly 500,000 emails have been sent out so far as part of a massive multifaceted phishing campaign targeting customers of JPMorgan Chase.

Study: Organizations lack training, budget to thwart insider threats

Study: Organizations lack training, budget to thwart insider ...

Of the 355 IT and security professionals surveyed, a majority indicated that they were ill-equipped to thwart a possible insider threat.