Executive Summary

Informations
Name CVE-2009-1536 First vendor Publication 2009-08-12
Vendor Cve Last vendor Modification 2024-11-21

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:H/Au:N/C:N/I:N/A:P)
Cvss Base Score 2.6 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity High
Cvss Expoit Score 4.9 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request scheduling, which allows remote attackers to cause a denial of service (daemon outage) via a series of crafted HTTP requests, aka "Remote Unauthenticated Denial of Service in ASP.NET Vulnerability."

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1536

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-20 Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:6393
 
Oval ID: oval:org.mitre.oval:def:6393
Title: Remote Unauthenticated Denial of Service in ASP.NET Vulnerability
Description: ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request scheduling, which allows remote attackers to cause a denial of service (daemon outage) via a series of crafted HTTP requests, aka "Remote Unauthenticated Denial of Service in ASP.NET Vulnerability."
Family: windows Class: vulnerability
Reference(s): CVE-2009-1536
 Version: 3
Platform(s): Microsoft Windows Vista
Microsoft Windows Server 2008
 Product(s): Microsoft .NET Framework
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 4
Os 1
Os 2

OpenVAS Exploits

Date Description
2010-12-13 Name : Microsoft Windows ASP.NET Denial of Service Vulnerability(970957)
File : nvt/gb_ms09-036.nasl
2009-08-03 Name : Microsoft Visual Studio ATL Remote Code Execution Vulnerability (969706)
File : nvt/secpod_ms09-035.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
56905 Microsoft .NET Framework Request Scheduling Crafted HTTP Request Remote DoS

.NET Framework contains a flaw that may allow a remote denial of service. The issue is triggered by the way ASP.NET scheduling is managed , and will result in loss of availability for the IIS service.

Information Assurance Vulnerability Management (IAVM)

Date Description
2009-08-13 IAVM : 2009-B-0036 - Microsoft ASP.NET Denial of Service Vulnerability
Severity : Category I - VMSKEY : V0019878
2009-07-30 IAVM : 2009-B-0033 - Multiple Vulnerabilities in Visual Studio Active Template Library
Severity : Category II - VMSKEY : V0019798

Snort® IPS/IDS

Date Description
2021-01-26 Microsoft ASP.NET bad request denial of service attempt
RuleID : 56804 - Revision : 1 - Type : SERVER-IIS
2017-08-31 Microsoft ASP.NET bad request denial of service attempt
RuleID : 43808 - Revision : 1 - Type : SERVER-IIS
2017-08-31 Microsoft ASP.NET bad request denial of service attempt
RuleID : 43807 - Revision : 1 - Type : SERVER-IIS
2014-01-10 Microsoft ASP.NET bad request denial of service attempt
RuleID : 15851 - Revision : 11 - Type : SERVER-IIS

Nessus® Vulnerability Scanner

Date Description
2009-10-13 Name : The remote Windows host has multiple ActiveX controls that are affected by mu...
File : smb_nt_ms09-055.nasl - Type : ACT_GATHER_INFO
2009-08-11 Name : The remote .Net Framework is susceptible to a denial of service attack.
File : smb_nt_ms09-036.nasl - Type : ACT_GATHER_INFO
2009-07-30 Name : Arbitrary code can be executed on the remote host through Microsoft Active Te...
File : smb_nt_ms09-035.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

http://blogs.technet.com/srd/archive/2009/08/11/ms09-035-asp-net-denial-of-se...
http://osvdb.org/56905
http://secunia.com/advisories/36127
http://www.securityfocus.com/bid/35985
http://www.securitytracker.com/id?1022715
http://www.us-cert.gov/cas/techalerts/TA09-223A.html
http://www.vupen.com/english/advisories/2009/2231
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09...
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
Source Url

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
Date Informations
2024-11-28 23:10:40
  • Multiple Updates
2024-11-28 12:18:53
  • Multiple Updates
2024-08-02 12:11:29
  • Multiple Updates
2024-08-02 01:03:07
  • Multiple Updates
2024-02-02 01:11:00
  • Multiple Updates
2024-02-01 12:03:05
  • Multiple Updates
2023-09-05 12:10:17
  • Multiple Updates
2023-09-05 01:02:56
  • Multiple Updates
2023-09-02 12:10:23
  • Multiple Updates
2023-09-02 01:02:58
  • Multiple Updates
2023-08-12 12:12:11
  • Multiple Updates
2023-08-12 01:02:57
  • Multiple Updates
2023-08-11 12:10:25
  • Multiple Updates
2023-08-11 01:03:04
  • Multiple Updates
2023-08-06 12:10:01
  • Multiple Updates
2023-08-06 01:02:59
  • Multiple Updates
2023-08-04 12:10:06
  • Multiple Updates
2023-08-04 01:03:01
  • Multiple Updates
2023-07-14 12:10:04
  • Multiple Updates
2023-07-14 01:02:59
  • Multiple Updates
2023-03-29 01:11:33
  • Multiple Updates
2023-03-28 12:03:05
  • Multiple Updates
2022-10-11 12:08:57
  • Multiple Updates
2022-10-11 01:02:48
  • Multiple Updates
2021-05-04 12:09:31
  • Multiple Updates
2021-04-22 01:09:52
  • Multiple Updates
2021-01-26 21:23:17
  • Multiple Updates
2020-11-24 12:05:04
  • Multiple Updates
2020-05-23 00:23:44
  • Multiple Updates
2018-10-13 00:22:49
  • Multiple Updates
2017-11-21 17:22:22
  • Multiple Updates
2017-09-29 09:24:12
  • Multiple Updates
2016-06-28 17:40:48
  • Multiple Updates
2016-04-26 18:48:13
  • Multiple Updates
2014-02-17 10:49:54
  • Multiple Updates
2014-01-19 21:25:53
  • Multiple Updates
2013-11-11 12:38:18
  • Multiple Updates
2013-05-10 23:49:48
  • Multiple Updates