Quick action to patch ASP.NET vulnerability
Quick action to patch ASP.NET vulnerability
Written by Kay Ewbank   
Thursday, 29 December 2011

Microsoft is releasing an out-of-band security update today for an ASP.NET Security Vulnerability revealed yesterday, December 28, 2011.

The update overcomes a security hole that could be used to launch Denial of Service attacks, though Microsoft says it is currently unaware of any attacks on ASP.NET customers using this exploit.

aspnet

The problem doesn’t just affect ASP.NET; the method described would work with products including PHP 4 and 5, Java, Apache Tomcat and Geronimo, Jetty, Oracle Glassfish, Python, Plone, CRuby 1.8, JRuby and Rubinius v8, according to details posted on the gmane.comp.security full disclosure mailing list.

The details of the potential attack method were given at the Chaos Communication Congress conference, where security researchers Julian Wälde and Alexander Klink showed a new way to attack Web Application Frameworks which exploits hash-table data-structures.

According to Microsoft’s Security Bulletin, hash collision attacks attempt to populate a hash-table within a server app with large numbers of items whose keys resolve to the same hash code. These key collisions can significantly slow down operations on the hash-table, and with enough elements can cause a server to spend minutes (or even hours) processing them. This can block a web server from processing requests from other users, and cause a denial of service.

The bulletin also points out that because these attacks on web frameworks can create Denial of Service issues with relatively few HTTP requests, there is a high likelihood of attacks happening using this approach.

It’s worth noting that if your site disallows application/x-www-form-urlencoded or multipart/form-data HTTP content types, it won’t be vulnerable. However, Microsoft is releasing an out-of-band security update on Thursday, December 29 at approximately 10am Pacific Time.

 

aspnet

 

To be informed about new articles on I Programmer, subscribe to the RSS feed, follow us on Google+, Twitter, Linkedin or Facebook or sign up for our weekly newsletter.


Banner


Artificial Intelligence in Pokémons' Service
27/08/2016

Even AI cannot escape Pokémons Go's viral craze after Human Intelligence readily submitted.That's all due to a bright idea of combining IBM's Watson AI with the gameplay of Pokémon Go.



Hollerith Census Machine - A Milestone In Big Data Big
16/08/2016

August 16, 1890 was the date on which the US Census Bureau announced that the US population was 62,662,250. It was the first time that machinery was used to automate the process and the use of Holleri [ ... ]


More News

Last Updated ( Thursday, 29 December 2011 )
 
 

   
Banner
RSS feed of news items only
I Programmer News
Copyright © 2016 i-programmer.info. All Rights Reserved.
Joomla! is Free Software released under the GNU/GPL License.