CVE-2009-1536

LOW 2.6CVE-2009-1536 · Published 12/08/2009 · updated 16/06/2026

Package	Affected versions	Patched versions
.net framework microsoft	`= 2.0= 3.5`	No fix yet

Description

ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request scheduling, which allows remote attackers to cause a denial of service (daemon outage) via a series of crafted HTTP requests, aka "Remote Unauthenticated Denial of Service in ASP.NET Vulnerability."

References

blogs.technet.com/srd/archive/2009/08/11/ms09-035-asp-net-denial-of-service-vulnerability.aspx · Vendor Advisory
osvdb.org/56905 · Broken Link
secunia.com/advisories/36127 · Third Party Advisory
securityfocus.com/bid/35985 · Patch
securitytracker.com/id · Third Party Advisory
us-cert.gov/cas/techalerts/TA09-223A.html · Third Party Advisory
vupen.com/english/advisories/2009/2231 · Permissions Required
docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-036
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6393 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free