CVE-2009-1536

ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request scheduling, which allows remote attackers to cause a denial of service (daemon outage) via a series of crafted HTTP requests, aka "Remote Unauthenticated Denial of Service in ASP.NET Vulnerability."
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
2.6 UNKNOWN
NETWORK
HIGH
AV:N/AC:H/Au:N/C:N/I:N/A:P
microsoftCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 97%
VendorProductVersion
microsoft.net_framework
2.0:sp1
microsoft.net_framework
2.0:sp2
microsoft.net_framework
3.5
microsoft.net_framework
3.5:sp1
microsoftwindows_server_2008
-
microsoftwindows_vista
*
microsoftwindows_vista
-
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://blogs.technet.com/srd/archive/2009/08/11/ms09-035-asp-net-denial-of-service-vulnerability.aspx
http://osvdb.org/56905
http://secunia.com/advisories/36127
http://www.securityfocus.com/bid/35985
http://www.securitytracker.com/id?1022715
http://www.us-cert.gov/cas/techalerts/TA09-223A.html
http://www.vupen.com/english/advisories/2009/2231
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-036
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6393
http://blogs.technet.com/srd/archive/2009/08/11/ms09-035-asp-net-denial-of-service-vulnerability.aspx
http://osvdb.org/56905
http://secunia.com/advisories/36127
http://www.securityfocus.com/bid/35985
http://www.securitytracker.com/id?1022715
http://www.us-cert.gov/cas/techalerts/TA09-223A.html
http://www.vupen.com/english/advisories/2009/2231
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-036
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6393