Microsoft scrambles to address widespread ASP.NET bug

Powered by SC Magazine
 

Bug impacts entire .Net framework.

Microsoft has warned of an unpatched but publicly known vulnerability affecting ASP.NET, a web application framework that allows developers to build enterprise-grade web applications.

The flaw affects all versions of the .NET Framework, but so far Microsoft is not aware of any in-the-wild attacks, Dave Forstrom, director of Microsoft Trustworthy Computing, said in a blog post. However, the software giant anticipates exploit code to quickly be developed, and security experts said an emergency fix could come as early as this week.

What makes the bug particularly worrisome is that it enables attackers to use limited means to launch a devastating denial-of-service (DoS) attack against web servers. According to Microsoft, "a single, specially crafted ~100kb HTTP request can consume 100 percent of one CPU core for between 90 to 110 seconds."

"The vulnerability could allow an anonymous attacker to efficiently consume all CPU resources on a web server, or even a cluster of web servers [rendering ASP.NET pages]," Microsoft engineers Suha Can and Jonathan Ness wrote in a blog post. "An attacker could potentially repeatedly issue such requests, causing performance to degrade significantly enough to cause a denial-of-service condition for even multi-core servers or clusters of servers."

Andrew Storms, director of security operations at vulnerability management firm nCircle, said this type of DoS attack is highly unusual.

"This isn't your average DoS attack because it doesn't take a botnet or a lot of coordination to take a web server down," he said. "Most DoS attacks rely on a huge number of small requests targeted at a specific web server to overwhelm it."

The vulnerability is caused by an error in the way ASP.NET handles values in an ASP.NET form post to cause a "hash collision," which happens when two unique pieces of data have the same hash values.

In an advisory, Microsoft has released workaround details. In addition, the company has provided its Active Protections Program (MAPP) partners with detection guidance.

Storms said the issue is not unique to ASP.NET.

"It's highly likely that this attack isn't (Microsoft) specific and probably affects a number of vendors, and we can expect other vendors to make similar zero-day announcements," he said. "Everybody will be scrambling to come up with mitigation advice and patch strategies."

This article originally appeared at scmagazineus.com

Copyright © SC Magazine, US edition


Microsoft scrambles to address widespread ASP.NET bug
 
 
 
Top Stories
Change is the only constant at iiNet
iiNet's Matthew Toohey is trialling IBM's Watson - between preparing for an acquisition and making sure Netflix doesn't swamp the network.
 
Why straight-through processing is the holy grail for banks
Big benefits from stripping away human intervention and digitising processes.
 
CBA sued over frozen millions in IT bribery scandal
Eric Pulier's not-for profit lodges lawsuit in US.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
New features are coming to Outlook.com
May 27, 2015
Outlook.com, thanks to its predecessor Hotmail.com, is one of the world's major webmail services ...
Windows 10 to feature integrated apps for Android and iOS
May 27, 2015
Microsoft reveals multi-platform Cortana connectivity for Windows 10. What the heck is that, and ...
Microsoft launches Office for Android preview
May 22, 2015
Microsoft has launched a preview of Office for Android smartphones. Pre-release versions of ...
Microsoft is working on an iOS email chat feature called Flow
May 22, 2015
Microsoft is working on a new chat app, but at the moment we know more about what we DON'T know, ...
Windows 10 free upgrade: Microsoft details who gets what
May 22, 2015
Microsoft was meant to be streamlining its OS with Windows 10, so why is upgrading so confusing? ...
Latest Comments
Polls
Should Optus make a bid for iiNet?

   |   View results
Yes
  44%
 
No
  56%
TOTAL VOTES: 665

Vote