CVE-2009-1536
published 2009-08-12CVE-2009-1536: ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request…
PriorityP266low2.6CVSS 2.0
AVNACHAuNCNINAP
ITWVulnCheck KEV
Exploited in the wild
EPSS
51.32%
98.8th percentile
ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request scheduling, which allows remote attackers to cause a denial of service (daemon outage) via a series of crafted HTTP requests, aka "Remote Unauthenticated Denial of Service in ASP.NET Vulnerability."
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | net_framework | — | — |
| microsoft | net_framework | — | — |
CVSS provenance
nvdv2.02.6LOWAV:N/AC:H/Au:N/C:N/I:N/A:P
vulncheck2.6LOW
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-q2cv-9hv3-xqxf: ASP
ghsa_unreviewed·2022-05-02
CVE-2009-1536 [LOW] CWE-20 GHSA-q2cv-9hv3-xqxf: ASP
ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request scheduling, which allows remote attackers to cause a denial of service (daemon outage) via a series of crafted HTTP requests, aka "Remote Unauthenticated Denial of Service in ASP.NET Vulnerability."
VulnCheck
Microsoft .NET Framework Improper Input Validation
vulncheck·2009·CVSS 2.6
CVE-2009-1536 [LOW] Microsoft .NET Framework Improper Input Validation
Microsoft .NET Framework Improper Input Validation
ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request scheduling, which allows remote attackers to cause a denial of service (daemon outage) via a series of crafted HTTP requests, aka "Remote Unauthenticated Denial of Service in ASP.NET Vulnerability."
Affected: Microsoft .NET Framework
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://learn.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-036
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://blogs.technet.com/srd/archive/2009/08/11/ms09-035-asp-net-denial-of-service-vulnerability.aspxhttp://osvdb.org/56905http://secunia.com/advisories/36127http://www.securityfocus.com/bid/35985http://www.securitytracker.com/id?1022715http://www.us-cert.gov/cas/techalerts/TA09-223A.htmlhttp://www.vupen.com/english/advisories/2009/2231https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-036https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6393http://blogs.technet.com/srd/archive/2009/08/11/ms09-035-asp-net-denial-of-service-vulnerability.aspxhttp://osvdb.org/56905http://secunia.com/advisories/36127http://www.securityfocus.com/bid/35985http://www.securitytracker.com/id?1022715http://www.us-cert.gov/cas/techalerts/TA09-223A.htmlhttp://www.vupen.com/english/advisories/2009/2231https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-036https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6393
2009-08-12
Published
Exploited in the wild