CVE-2009-1536

CVSS V2 Low 2.6 CVSS V3 None
Description
ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request scheduling, which allows remote attackers to cause a denial of service (daemon outage) via a series of crafted HTTP requests, aka "Remote Unauthenticated Denial of Service in ASP.NET Vulnerability."
Overview
  • CVE ID
  • CVE-2009-1536
  • Assigner
  • secure@microsoft.com
  • Vulnerability Status
  • Modified
  • Published Version
  • 2009-08-12T17:30:00
  • Last Modified Date
  • 2018-10-12T21:51:19
Weakness Enumerations
CWE URL
CWE-20 http://cwe.mitre.org/data/definitions/20.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:microsoft:.net_framework:2.0:sp1:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:microsoft:.net_framework:3.5:sp1:*:*:*:*:*:* 1 OR
cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:* 1 OR
cpe:2.3:o:microsoft:windows_vista:-:sp1:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:H/Au:N/C:N/I:N/A:P
  • Access Vector
  • NETWORK
  • Access Compatibility
  • HIGH
  • Authentication
  • NONE
  • Confidentiality Impact
  • NONE
  • Integrity Impact
  • NONE
  • Availability Impact
  • PARTIAL
  • Base Score
  • 2.6
  • Severity
  • LOW
  • Exploitability Score
  • 4.9
  • Impact Score
  • 2.9
References
Reference URL Reference Tags
http://secunia.com/advisories/36127 Third Party Advisory
http://www.securityfocus.com/bid/35985 Patch Third Party Advisory VDB Entry
http://www.vupen.com/english/advisories/2009/2231 Permissions Required Third Party Advisory
http://www.securitytracker.com/id?1022715 Third Party Advisory VDB Entry
http://osvdb.org/56905 Broken Link
http://blogs.technet.com/srd/archive/2009/08/11/ms09-035-asp-net-denial-of-service-vulnerability.aspx Vendor Advisory
http://www.us-cert.gov/cas/techalerts/TA09-223A.html Third Party Advisory US Government Resource
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6393 Third Party Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-036
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2009-1536
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1536
History
Created Old Value New Value Data Type Notes
2022-05-10 18:24:48 Added to TrackCVE