The CaseInsensitiveHashProvider.getHashCode function in the HashTable implementation in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka "Collisions in HashTable May Cause DoS Vulnerability."
| Version | Base score | Base severity | Vector |
|---|
| Hyperlink | Resource Type |
|---|
The CaseInsensitiveHashProvider.getHashCode function in the HashTable implementation in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka "Collisions in HashTable May Cause DoS Vulnerability."
| Type | CWE ID | Description |
|---|---|---|
| text | N/A | n/a |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14588 | vdb-entry signature x_refsource_OVAL |
| http://www.nruns.com/_downloads/advisory28122011.pdf | x_refsource_MISC |
| http://www.us-cert.gov/cas/techalerts/TA11-347A.html | third-party-advisory x_refsource_CERT |
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-100 | vendor-advisory x_refsource_MS |
| http://www.kb.cert.org/vuls/id/903934 | third-party-advisory x_refsource_CERT-VN |
| http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html | mailing-list x_refsource_BUGTRAQ |
| http://www.ocert.org/advisories/ocert-2011-003.html | x_refsource_MISC |
| Version | Base score | Base severity | Vector |
|---|
| CAPEC ID | Description |
|---|
| Event | Date |
|---|
| Hyperlink | Resource |
|---|---|
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14588 | vdb-entry signature x_refsource_OVAL x_transferred |
| http://www.nruns.com/_downloads/advisory28122011.pdf | x_refsource_MISC x_transferred |
| http://www.us-cert.gov/cas/techalerts/TA11-347A.html | third-party-advisory x_refsource_CERT x_transferred |
| https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-100 | vendor-advisory x_refsource_MS x_transferred |
| http://www.kb.cert.org/vuls/id/903934 | third-party-advisory x_refsource_CERT-VN x_transferred |
| http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html | mailing-list x_refsource_BUGTRAQ x_transferred |
| http://www.ocert.org/advisories/ocert-2011-003.html | x_refsource_MISC x_transferred |
The CaseInsensitiveHashProvider.getHashCode function in the HashTable implementation in the ASP.NET subsystem in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5 SP1, 3.5.1, and 4.0 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters, aka "Collisions in HashTable May Cause DoS Vulnerability."
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 2.0 | 7.8 | HIGH | AV:N/AC:L/Au:N/C:N/I:N/A:C |