Microsoft informed users on Wednesday that Windows servers running Internet Information Services (IIS) are vulnerable to denial-of-service (DoS) attacks that rely on malicious HTTP/2 requests.
According to the tech giant, sending specially crafted HTTP/2 requests can cause the machine’s CPU to temporarily spike to 100% until IIS kills the malicious connections.
“The HTTP/2 specification allows clients to specify any number of SETTINGS frames with any number of SETTINGS parameters. In some situations, excessive settings can cause services to become unstable and may result in a temporary CPU usage spike until the connection timeout is reached and the connection is closed,” Microsoft said in its advisory.
The vulnerability impacts Windows 10, Windows Server and Windows Server 2016. The February non-security updates released by Microsoft this week should address the issue by allowing IIS administrators to define thresholds on the number of HTTP/2 SETTINGS included in a request.
However, Microsoft noted that the updates it has released do not define any values by default and IIS administrators must do it themselves. The knowledge base article that should provide information on how to do this could not be accessed at the time of writing.
Microsoft has credited Gal Goldshtein of F5 Networks for reporting the vulnerability. It’s worth noting that a similar flaw, tracked as CVE-2018-16844, was discovered recently by Goldshtein in the nginx open source web server software.
“The flaw in Microsoft IIS could cause serious problems for organizations using IIS for their corporate website or applications. While Microsoft has developed a patch to fix this issue, it is still up to the IT team to properly configure IIS so the problem can’t be created. Microsoft specifically stated that they do not provide presets and as such fixing the problem is more than just applying the patch,” said Justin Jett, Director of Audit and Compliance at Plixer.
“IT teams should use network traffic analytics to look at connections going to their IIS servers to determine if they have connections going to their web servers that could be creating these problems. Often these connections are long-lived or the source connection continuously repeats to trigger a problem on the server. By looking at these metrics, IT teams can identify the source of the DDoS. These types of problems can be resolved with proper configuration. Network traffic analytics can help you understand where there may be configuration issues so the system can be updated before there are major problems like DDoS attacks,” Jett added.
Related: Windows Kernel Vulnerability Exploited in Attacks
Related: Microsoft Patches Actively Exploited Windows Vulnerability
Related: Windows Zero-Day Exploited by New ‘SandCat’ Group
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Zyxel Firewalls Hacked by Mirai Botnet
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
- Drop in Insider Breaches Drives Decline in Intrusions at OT Organizations
- Zero-Day Vulnerability Exploited to Hack Barracuda Email Security Gateway Appliances
- OAuth Vulnerabilities in Widely Used Expo Framework Allowed Account Takeovers
- New Honeywell OT Cybersecurity Solution Helps Identify Vulnerabilities, Threats
- Rheinmetall Says Military Business Not Impacted by Ransomware Attack
Latest News
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Organizations Worldwide Targeted in Rapidly Evolving Buhti Ransomware Operation
- Google Cloud Users Can Now Automate TLS Certificate Lifecycle
- Zyxel Firewalls Hacked by Mirai Botnet
- Watch Now: Threat Detection and Incident Response Virtual Summit
- NCC Group Releases Open Source Tools for Developers, Pentesters
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
