Microsoft Security Advisory (2659883)

ronjor · Dec 28, 2011

Vulnerability in ASP.NET Could Allow Denial of Service

Published: Wednesday, December 28, 2011

Version: 1.0
General Information
Executive Summary

Microsoft is aware of detailed information that has been published describing a new method to exploit hash tables. Attacks targeting this type of vulnerability are generically known as hash collision attacks. Attacks such as these are not specific to Microsoft technologies and affect other web service software providers. This vulnerability affects all versions of Microsoft .NET Framework and could allow for an unauthenticated denial of service attack on servers that serve ASP.NET pages. Sites that only serve static content or disallow dynamic content types listed in the mitigation factors below are not vulnerable.

The vulnerability exists due to the way that ASP.NET processes values in an ASP.NET form post causing a hash collision. It is possible for an attacker to send a small number of specially crafted posts to an ASP.NET server, causing performance to degrade significantly enough to cause a denial of service condition. Microsoft is aware of detailed information available publicly that could be used to exploit this vulnerability but is not aware of any active attacks.

Details of a workaround to help protect sites against this vulnerability are provided in this article. Individual implementations for sites using ASP.NET will vary and Microsoft strongly suggests customers evaluate the impact of the workaround for applicability to their implementations.

We are actively working with partners in our Microsoft Active Protections Program (MAPP) to provide information that they can use to provide broader protections to customers.

Upon completion of this investigation, Microsoft will take the appropriate action to help protect our customers. This may include providing a security update through our monthly release process or providing an out-of-cycle security update, depending on customer needs.

Mitigating Factors:

By default, IIS is not enabled on any supported Windows operating system
Sites that disallow application/x-www-form-urlencoded or multipart/form-data HTTP content types are not vulnerable
Click to expand...

https://technet.microsoft.com/en-us/security/advisory/2659883

ronjor · Dec 28, 2011

Microsoft releases Security Advisory 2659883, offers workaround for industry-wide issue

MSRCTeam
28 Dec 2011 4:57 AM

Hello,

Today we published Security Advisory 2659883 to provide a workaround to help protect ASP.NET customers from a publicly disclosed vulnerability that affects various Web platforms industry-wide. We are not aware of any attacks using this vulnerability, which affects all supported versions of .NET Framework, however we recommend customers use the mitigation and workaround described in the Advisory to help protect sites against this new method to exploit hash tables.

Our teams are working around the clock worldwide to develop a security update of appropriate quality to address this issue. Meanwhile, our Security Research & Defense team has written a blog post to explain how to know if you are vulnerable and detect exploitation, as well as background on the workaround. We are also working closely with our Microsoft Active Protections Program (MAPP) to help our partners build protections when and where possible. We will continue to update customers with new information as it becomes available.
Click to expand...

https://blogs.technet.com/b/msrc/ar...-for-industry-wide-issue.aspx?Redirected=true

ronjor · Dec 29, 2011

Advanced Notification for out-of-band release to address Security Advisory 2659883

MSRCTeam
28 Dec 2011 7:51 PM

Hello,

Today we’re providing advance notification for an out-of-band security update to address the publicly disclosed issue described in Security Advisory 2659883. The release is scheduled for tomorrow, December 29, at approximately 10 a.m. PST.
Click to expand...

https://blogs.technet.com/b/msrc/ar...ecurity-advisory-2659883.aspx?Redirected=true

NICK ADSL UK · Dec 29, 2011

Microsoft Security Bulletin for December 29th 2011 Out of Band

Bulletin Summary:
http://technet.microsoft.com/en-us/security/bulletin/ms11-dec

Critical (1)

Microsoft Security Bulletin MS11-100
Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (2638420)

http://technet.microsoft.com/en-us/security/bulletin/ms11-100

ronjor · Dec 29, 2011

Today we released MS11-100, addressing a newly disclosed denial-of-service vulnerability affecting several vendors’ Web application platforms, including Microsoft’s ASP.NET. Yesterday, we posted an SRD blog describing the vulnerability and the detection and workaround opportunities. With this blog post, we’d like to update you on the following topics:

Why is this bulletin rated “Critical” for a Denial-of-Service vulnerability?

Signature progress from protection partners

Updated snort rules

Thanks to the ASP.NET team for holiday heroics
Click to expand...

https://blogs.technet.com/b/srd/arc...-security-update-is-live.aspx?Redirected=true

MrBrian · Dec 30, 2011

December 2011 Out-Of-Band Security Bulletin Webcast Q&A

ronjor · Dec 30, 2011

The following bulletins have undergone a minor revision increment.
Please see the appropriate bulletin for more details.

* MS11-100 - Critical

Bulletin Information:
=====================

* MS11-100 - Critical

- http://technet.microsoft.com/security/bulletin/MS11-100
- Reason for Revision: V1.1 (December 30, 2011): Added entry
to the Update FAQ to address security-rated changes to
functionality contained in this update and added mitigation
for CVE-2011-3414.
- Originally posted: December 29, 2011
- Updated: December 30, 2011
- Bulletin Severity Rating: Critical
- Version: 1.1
Click to expand...

.....

Log in or Sign up

Microsoft Security Advisory (2659883)

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

NICK ADSL UK Administrator

ronjor Global Moderator

MrBrian Registered Member

ronjor Global Moderator

Log in or Sign up

Microsoft Security Advisory (2659883)

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

NICK ADSL UK Administrator

ronjor Global Moderator

MrBrian Registered Member

ronjor Global Moderator

Useful Searches