Although not yet being exploited in the wild, Microsoft decided the potential for trouble was sufficient to act in what will be its only standalone fix for the whole of 2011.
An attacker exploiting Security Advisory 2659883, rated critical, could exploit a weakness in the way ASP.NET and a number of other web applications including Java and PHP 5 generate hash tables from an HTTP POST request, eating a server CPU’s entire resources for a period of time with a single file.
Normally, a denial of service attack with that level of success would require a botnet of thousands of hundreds of thousands of computers to make much headway on all but the most modestly-defended servers.
“An attacker could potentially repeatedly issue such requests, causing performance to degrade significantly enough to cause a denial of service condition for even multi-core servers or clusters of servers,” Microsoft said this week in its advisory.
The flaw was only put into the public domain earlier this week at the Chaos Communication Congress in Berlin by researchers Alexander Klink and Julian Wlde, about a month after they informed Microsoft itself, which has garnered Microsoft some praise from researchers for a rapid response.
“We consider Microsoft’s reaction and implementation speed outstanding, as they were only notified at the tail end of the German security researchers work. We will be tracking how the other projects and vendors affected (PHP, Oracle, Phython, Ruby and others) are rolling out their patches,” said Qualys CTO, Wolfgang Kandek.
Andrew Storms of nCircle was simply impressed that Microsoft had responded at all over a period many companies switch off.
“Today’s [Thursday’s] out-of-band patch is the first one this year, and it breaks what would have been a perfect record for Microsoft’s 2011 patch schedule. I’m sure a few people on Microsoft’s security team are packing up the champagne that was ready for that end of year victory toast,” he said.