Connect with us

Hi, what are you looking for?



Windows Servers Vulnerable to DoS Attacks, Microsoft Warns

Microsoft informed users on Wednesday that Windows servers running Internet Information Services (IIS) are vulnerable to denial-of-service (DoS) attacks that rely on malicious HTTP/2 requests.

Microsoft informed users on Wednesday that Windows servers running Internet Information Services (IIS) are vulnerable to denial-of-service (DoS) attacks that rely on malicious HTTP/2 requests.

According to the tech giant, sending specially crafted HTTP/2 requests can cause the machine’s CPU to temporarily spike to 100% until IIS kills the malicious connections.

“The HTTP/2 specification allows clients to specify any number of SETTINGS frames with any number of SETTINGS parameters. In some situations, excessive settings can cause services to become unstable and may result in a temporary CPU usage spike until the connection timeout is reached and the connection is closed,” Microsoft said in its advisory.

The vulnerability impacts Windows 10, Windows Server and Windows Server 2016. The February non-security updates released by Microsoft this week should address the issue by allowing IIS administrators to define thresholds on the number of HTTP/2 SETTINGS included in a request.

However, Microsoft noted that the updates it has released do not define any values by default and IIS administrators must do it themselves. The knowledge base article that should provide information on how to do this could not be accessed at the time of writing.

Microsoft has credited Gal Goldshtein of F5 Networks for reporting the vulnerability. It’s worth noting that a similar flaw, tracked as CVE-2018-16844, was discovered recently by Goldshtein in the nginx open source web server software.

“The flaw in Microsoft IIS could cause serious problems for organizations using IIS for their corporate website or applications. While Microsoft has developed a patch to fix this issue, it is still up to the IT team to properly configure IIS so the problem can’t be created. Microsoft specifically stated that they do not provide presets and as such fixing the problem is more than just applying the patch,” said Justin Jett, Director of Audit and Compliance at Plixer.

Advertisement. Scroll to continue reading.

“IT teams should use network traffic analytics to look at connections going to their IIS servers to determine if they have connections going to their web servers that could be creating these problems. Often these connections are long-lived or the source connection continuously repeats to trigger a problem on the server. By looking at these metrics, IT teams can identify the source of the DDoS. These types of problems can be resolved with proper configuration. Network traffic analytics can help you understand where there may be configuration issues so the system can be updated before there are major problems like DDoS attacks,” Jett added.

Related: Windows Kernel Vulnerability Exploited in Attacks

Related: Microsoft Patches Actively Exploited Windows Vulnerability

Related: Windows Zero-Day Exploited by New ‘SandCat’ Group

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join security experts as they discuss ZTNA’s untapped potential to both reduce cyber risk and empower the business.


Join Microsoft and Finite State for a webinar that will introduce a new strategy for securing the software supply chain.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...


The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.


A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...


Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.