We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
74,968 News Articles

Microsoft patches dangerous web flaw in double time

Denial of service hole closed

Microsoft has issued an out-of-band fix for a vulnerability in its ASP.NET web platform that could allow an attacker to launch a successful DoS attack on a server using a nothing more sophisticated than a stream of 100kb files.

Although not yet being exploited in the wild, Microsoft decided the potential for trouble was sufficient to act in what will be its only standalone fix for the whole of 2011.

An attacker exploiting Security Advisory 2659883, rated critical, could exploit a weakness in the way ASP.NET and a number of other web applications including Java and PHP 5 generate hash tables from an HTTP POST request, eating a server CPU's entire resources for a period of time with a single file.

Normally, a denial of service attack with that level of success would require a botnet of thousands of hundreds of thousands of computers to make much headway on all but the most modestly-defended servers.

"An attacker could potentially repeatedly issue such requests, causing performance to degrade significantly enough to cause a denial of service condition for even multi-core servers or clusters of servers," Microsoft said this week in its advisory.

The flaw was only put into the public domain earlier this week at the Chaos Communication Congress in Berlin by researchers Alexander Klink and Julian Wlde, about a month after they informed Microsoft itself, which has garnered Microsoft some praise from researchers for a rapid response.

"We consider Microsoft's reaction and implementation speed outstanding, as they were only notified at the tail end of the German security researchers work. We will be tracking how the other projects and vendors affected (PHP, Oracle, Phython, Ruby and others) are rolling out their patches," said Qualys CTO, Wolfgang Kandek.

Andrew Storms of nCircle was simply impressed that Microsoft had responded at all over a period many companies switch off.

"Today's [Thursday's] out-of-band patch is the first one this year, and it breaks what would have been a perfect record for Microsoft's 2011 patch schedule. I'm sure a few people on Microsoft's security team are packing up the champagne that was ready for that end of year victory toast," he said.

IDG UK Sites

Amazon 3D smartphone release date, price and spec: The hologram phone?

IDG UK Sites

You're never alone with a clone: How the App Store got taken over by copycats

IDG UK Sites

PCs vs consoles: PCs still pwn when it comes to gaming (and everything else)

IDG UK Sites

The art of rebranding: Creative agency The Neighbourhood explains how & why it rebranded