goHost

Security Reasearchers have discovered a long standing vulnerabilty in many popular web application languages that can lead to a denial of service (DoS) attack. Most programing languages including PHP, Java, Python and ASP.NET are vulnerable to this HashDos vulnerabltily.

A denial-of-service attack (DoS) overloads the server with multiple requests, effectively making it unable to serve a website to new visitors. Usually such an attack strong enough to overwhelm a server requires a lot of horsepower on the attacker’s side. This vulnerability however makes things significantly easier for an attacker.

Microsoft has released an emergency/out-of-band update (KB2659883 and MS11-100) to mitigate this issue in ASP.NET and .NET Frameworks.

All our Windows Server systems have already been patched with MS11-100.

Researchers recently presented their research at the 28c3 Security Conference. The specific details relate to hashing algorithms and managing hash collisions. A specially crafted request can force a website to consume all CPU resources in an effort to resolve and manage the hash collisons. The net effect of this increased CPU load can lead to a DoS on the website.

Without fixing the core hashing algorithims and functions there are a number of workarounds that can be used to mitigate the impact of the HashDos vulnerability.

• Reduce the length/size of HTTP parameters that can send via POST.
• Reduce the number of HTTP parameters accepted by the web application framework.
• Limit the amount of CPU time that any given thread is allowed to run.

These workarounds may negatively impact the operations of your web application and should be reviewed and tested before being deployed into a production enviroment.

References and further reading:

• http://en.wikipedia.org/wiki/Denial-of-service_attack
• http://en.wikipedia.org/wiki/Hash_collision
• http://technet.microsoft.com/en-us/security/advisory/2659883
• http://technet.microsoft.com/en-us/security/bulletin/ms11-100
• http://blogs.technet.com/b/srd/archive/2011/12/29/asp-net-security-update-is-live.aspx
• http://blogs.technet.com/b/srd/archive/2011/12/27/more-information-about-the-december-2011-asp-net-vulnerability.aspx

One of the greatest things about the Internet is the incredible amount of innovation that occurs on an almost daily basis. New or improved products, software and services are released all the time. Improvements and updates are sometimes major releases and sometimes small but important fixes to resolve bugs or security issues. It can be challenge to keep up with all these updates and changes but in the end it is usually more costly, complicated, and risky to not stay current and keep pace. Put simply: You must stay current because falling behind is far more expensive, risky and problematic than updating.

If you don’t update…

Internet security (or lack thereof) has had its share of press in the recent weeks. We have seen the large scale breach of Sony’s PlayStation Network service by hackers, the websites of organizations like PBS and the CIA attacked by the LulzSec group and the data breach of Citigroup are just some examples. All these events serve as a sobering reminder that in today’s Internet it is not a question of if you will eventually get hacked, but when.