cbcvebase.
CVE-2014-0253
published 2014-02-12

CVE-2014-0253: Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine TCP connection states, which allows remote attackers to…

medium5CVSS 3.1
AVNACLAuNCNINAP
ITW
Exploited in the wild
Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, and 4.5.1 does not properly determine TCP connection states, which allows remote attackers to cause a denial of service (ASP.NET daemon hang) via crafted HTTP requests that trigger persistent resource consumption for a (1) stale or (2) closed connection, as exploited in the wild in February 2014, aka "POST Request DoS Vulnerability."

Affected

7 ranges
VendorProductVersion rangeFixed in
microsoftnet_framework——
microsoftnet_framework——
microsoftnet_framework——
microsoftnet_framework——
microsoftnet_framework——
microsoftnet_framework——
microsoftnet_framework——

CVSS provenance

nvd5.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
vulncheck5.0MEDIUM