7.8
CVSSv2

CVE-2011-3414

CVSSv4: NA | CVSSv3: NA | CVSSv2: 7.8 | VMScore: 880 | EPSS: 0.9627 | KEV: Not Included
Published: 30/12/2011 Updated: 21/11/2024

Vulnerability Summary

The CaseInsensitiveHashProvider.getHashCode function in the HashTable implementation in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote malicious users to cause a denial of service (CPU consumption) by sending many crafted parameters, aka "Collisions in HashTable May Cause DoS Vulnerability."

Vulnerable Product Search on Vulmon Subscribe to Product

microsoft windows 7 -

microsoft windows server 2003

microsoft windows server 2008

microsoft windows server 2008 -

microsoft windows server 2008 r2

microsoft windows vista

microsoft windows vista -

microsoft windows xp

microsoft windows xp sp3

Github Repositories

Detect Hash Colisions Attach on ASP .net

UPDATE: Microsoft has a Fix Microsoft has published a fix, using a diferent approch as used here They are limiting the number of post parameters to exactly 1000 To install this update, use Windows Update or visit the link belowe: technetmicrosoftcom/en-us/security/bulletin/ms11-100mspx This project however can be used for study of the IIS Modules and for future prob