MS.ASP.NET.NumberOfCPUs.Requests.DoS

Release Date Aug 11, 2009
Severity medium
Impact Denial of Service: Remote attackers can crash vulnerable systems.
Description This indicates an attack attempt against a denial of service vulnerability in ASP.NET when running on IIS. The vulnerability is caused by an error when ASP.NET doesn't decrement a counter used to determine how many requests and concurrently being processed. It allows a remote attacker to cause ASP.NET to stop processing requests.
Affected Products Microsoft .NET Framework 2.0 Service Pack 1 Microsoft .NET Framework 2.0 Service Pack 2 Microsoft .NET Framework 3.5 Microsoft .NET Framework 3.5 Service Pack 1
Recommended Actions Apply patch, available from the web site: http://www.microsoft.com/technet/security/Bulletin/MS09-036.mspx
Coverage IPS VCM
Common Vulnerabilities and Exposures (CVE) CVE-2009-1536
Reference/s http://www.frsirt.com/english/advisories/2009/2231 (FrSIRT) http://www.securityfocus.com/bid/35985 (BugTraq) http://technet.microsoft.com/en-us/security/bulletin/MS09-036.mspx (MS-ID)

Fortinet