Microsoft scrambles to address widespread ASP.NET bug

Powered by SC Magazine
 

Bug impacts entire .Net framework.

Microsoft has warned of an unpatched but publicly known vulnerability affecting ASP.NET, a web application framework that allows developers to build enterprise-grade web applications.

The flaw affects all versions of the .NET Framework, but so far Microsoft is not aware of any in-the-wild attacks, Dave Forstrom, director of Microsoft Trustworthy Computing, said in a blog post. However, the software giant anticipates exploit code to quickly be developed, and security experts said an emergency fix could come as early as this week.

What makes the bug particularly worrisome is that it enables attackers to use limited means to launch a devastating denial-of-service (DoS) attack against web servers. According to Microsoft, "a single, specially crafted ~100kb HTTP request can consume 100 percent of one CPU core for between 90 to 110 seconds."

"The vulnerability could allow an anonymous attacker to efficiently consume all CPU resources on a web server, or even a cluster of web servers [rendering ASP.NET pages]," Microsoft engineers Suha Can and Jonathan Ness wrote in a blog post. "An attacker could potentially repeatedly issue such requests, causing performance to degrade significantly enough to cause a denial-of-service condition for even multi-core servers or clusters of servers."

Andrew Storms, director of security operations at vulnerability management firm nCircle, said this type of DoS attack is highly unusual.

"This isn't your average DoS attack because it doesn't take a botnet or a lot of coordination to take a web server down," he said. "Most DoS attacks rely on a huge number of small requests targeted at a specific web server to overwhelm it."

The vulnerability is caused by an error in the way ASP.NET handles values in an ASP.NET form post to cause a "hash collision," which happens when two unique pieces of data have the same hash values.

In an advisory, Microsoft has released workaround details. In addition, the company has provided its Active Protections Program (MAPP) partners with detection guidance.

Storms said the issue is not unique to ASP.NET.

"It's highly likely that this attack isn't (Microsoft) specific and probably affects a number of vendors, and we can expect other vendors to make similar zero-day announcements," he said. "Everybody will be scrambling to come up with mitigation advice and patch strategies."

This article originally appeared at scmagazineus.com

Copyright © SC Magazine, US edition


Microsoft scrambles to address widespread ASP.NET bug
 
 
 
Top Stories
Matching databases to Linux distros
Reviewed: OS-repository DBMSs, MariaDB vs MySQL.
 
Coalition's NBN cost-benefit study finds in favour of MTM
FTTP costs too much, would take too long.
 
Who'd have picked a BlackBerry for the Internet of Things?
[Blog] BlackBerry has a more secure future in the physical world.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Looking for storage? Seagate has five new small business NAS devices
Aug 22, 2014
Seagate has announced a new portfolio of Networked Attached Storage (NAS) solutions specifically ...
Run a small business in western Sydney?
Aug 15, 2014
This event might be of interest if you're looking to meet other people with a similar interest ...
Buying a tablet? Microsoft's Surface Pro 3 goes on sale this month
Aug 8, 2014
Microsoft has announced its Surface Pro 3 will go on sale in Australia on 28 August from ...
Apple's top MacBook Pro with Retina is now cheaper
Aug 1, 2014
Apple has updated its MacBook Pro range with faster processors and new pricing, including ...
Pass on carbon tax savings, warns ACCC
Jul 24, 2014
The ACCC is warning businesses that supply "regulated goods" to pass on any cost savings ...
Latest Comments
Polls
Which is the most prevalent cyber attack method your organisation faces?




   |   View results
Phishing and social engineering
  71%
 
Advanced persistent threats
  3%
 
Unpatched or unsupported software vulnerabilities
  11%
 
Denial of service attacks
  6%
 
Insider threats
  10%
TOTAL VOTES: 764

Vote