Exploit code for a recently patched denial-of-service (DoS) vulnerability that affects Microsoft's ASP.NET Web development platform has been published online, therefore increasing the risk of potential attacks.
The vulnerability, identified as CVE-2011-3414, was disclosed in December at the Chaos Communication Congress, Europe's largest and oldest hacker conference. Shortly afterward Microsoft published a security advisory and released an out-of-band patch for the flaw.
The type of attack facilitated by this vulnerability affects other Web application platforms as well and each of them has its own mitigation instructions. "This vulnerability could allow an anonymous attacker to efficiently consume all CPU resources on a web server, or even on a cluster of web servers," explained Suha Can and Jonathan Ness, two Microsoft Security Response Center (MSRC) engineers, in a blog post back in December.
"For ASP.NET in particular, a single specially crafted
View the Original article
Нема коментара:
Постави коментар