CVE-2009-1536

low · 2.6

ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request scheduling, which allows remote attackers to cause a denial of service (daemon outage) via a series of crafted HTTP requests, aka "Remote Unauthenticated Denial of Service in ASP.NET Vulnerability."

2.6

CVSS

51.3%

EPSS (exploit prob.)

99th

EPSS percentile

2009-08-12

Published

AV:N/AC:H/Au:N/C:N/I:N/A:P

Weaknesses

CWE-20

Affected products

Vendor	Product	Affected versions
microsoft	.net_framework	2.0
microsoft	.net_framework	2.0
microsoft	.net_framework	3.5
microsoft	.net_framework	3.5
microsoft	windows_server_2008	all versions
microsoft	windows_vista	all versions
microsoft	windows_vista	all versions

Check a specific version with /api/v1/cve/match.

References

http://blogs.technet.com/srd/archive/2009/08/11/ms09-035-asp-net-denial-of-service-vulnerability.aspx
http://osvdb.org/56905
http://secunia.com/advisories/36127
http://www.securityfocus.com/bid/35985
http://www.securitytracker.com/id?1022715
http://www.us-cert.gov/cas/techalerts/TA09-223A.html
http://www.vupen.com/english/advisories/2009/2231
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-036
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6393
http://blogs.technet.com/srd/archive/2009/08/11/ms09-035-asp-net-denial-of-service-vulnerability.aspx
http://osvdb.org/56905
http://secunia.com/advisories/36127
http://www.securityfocus.com/bid/35985
http://www.securitytracker.com/id?1022715
http://www.us-cert.gov/cas/techalerts/TA09-223A.html
http://www.vupen.com/english/advisories/2009/2231
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-036
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6393

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2009-1536