Shulou(Shulou.com)05/31 Report--

DoS vulnerabilities include sending malicious HTTP/2 connections, which may slow down or freeze the user's system. Microsoft issued a security alert outlining vulnerabilities in its web server technology. If exploited, it may block or slow down the entire system.

A denial of service (DoS) problem first detected by F5 Networks's Gal Goldshtein will affect HTTP/2 connections to Microsoft's Internet Information Services (IIS) platform, which is built for use with the Windows NT operating system.

Malicious HTTP/2 requests can be sent to the Windows server running IIS, which will cause the system's CPU utilization to soar to 100% until the malicious connection is killed by IIS, as summarized in the company's consulting report released yesterday.

The security alert states: "the HTTP/2 specification allows clients to specify any number of SETTINGS frames using any number of SETTINGS parameters."

In some cases, too many settings can cause the service to become unstable and may cause temporary CPU usage to surge until the connection timeout is reached and the connection is closed

Microsoft has not found any mitigation measures or solutions, but users are advised to install the "unsafe update" in February and check the "knowledge base article", which found an error message while writing a 404 page link-No.

The company also attempts to mitigate the vulnerability by providing users with the ability to define thresholds for setting parameters contained in HTTP/2 requests.

Microsoft added that after patching the system with recently released cumulative updates, system administrators can customize HTTP/2 thresholds to prevent errors from slowing down or blocking their IIS network services.

Recently, Microsoft has had to deal with some high-profile vulnerabilities, especially when it launched a major upgrade to its Windows 10 operating system. As a result, the company has begun early testing of major updates due in 2020, much earlier than the usual process.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.