Unscored severity · published Aug 12, 2009
CVE-2009-1536
ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request scheduling, which…
–
CVSS
51.3%
EPSS
No
On KEV
Description
ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request scheduling, which allows remote attackers to cause a denial of service (daemon outage) via a series of crafted HTTP requests, aka "Remote Unauthenticated Denial of Service in ASP.NET Vulnerability."
Exploitation
Is it being used?
Exploit prediction (EPSS)51.3% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NF
.net Framework · Microsoft
2.0; 2.0; 3.5; 3.5 · source: NVD
WS
Windows Server 2008 · Microsoft
All versions, or not specified · source: NVD
WV
Windows Vista · Microsoft
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-1536
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-1536
Vendor Advisory
http://blogs.technet.com/srd/archive/2009/08/11/ms09-035-asp-net-denial-of-service-vulnerability.aspx
Broken Link
http://osvdb.org/56905
Third Party Advisory
http://secunia.com/advisories/36127
Patch
http://www.securityfocus.com/bid/35985
Third Party Advisory
http://www.securitytracker.com/id?1022715
Third Party Advisory
http://www.us-cert.gov/cas/techalerts/TA09-223A.html
More from .net Framework
9.8
CVE-2020-0646
Microsoft .NET Framework Remote Code Execution Vulnerability
7.8
CVE-2020-1147
Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability
7.8
CVE-2017-8759
Microsoft .NET Framework Remote Code Execution Vulnerability
7.8
CVE-2015-1671
Microsoft Windows Remote Code Execution Vulnerability
7.5
CVE-2024-29059
.NET Framework Information Disclosure Vulnerability