Microsoft informed users on Wednesday that Windows servers running Internet Information Services (IIS) are vulnerable to denial-of-service (DoS) attacks that rely on malicious HTTP/2 requests.
According to the tech giant, sending specially crafted HTTP/2 requests can cause the machine’s CPU to temporarily spike to 100% until IIS kills the malicious connections.
“The HTTP/2 specification allows clients to specify any number of SETTINGS frames with any number of SETTINGS parameters. In some situations, excessive settings can cause services to become unstable and may result in a temporary CPU usage spike until the connection timeout is reached and the connection is closed,” Microsoft said in its advisory.
The vulnerability impacts Windows 10, Windows Server and Windows Server 2016. The February non-security updates released by Microsoft this week should address the issue by allowing IIS administrators to define thresholds on the number of HTTP/2 SETTINGS included in a request.
However, Microsoft noted that the updates it has released do not define any values by default and IIS administrators must do it themselves. The knowledge base article that should provide information on how to do this could not be accessed at the time of writing.
Microsoft has credited Gal Goldshtein of F5 Networks for reporting the vulnerability. It’s worth noting that a similar flaw, tracked as CVE-2018-16844, was discovered recently by Goldshtein in the nginx open source web server software.
“The flaw in Microsoft IIS could cause serious problems for organizations using IIS for their corporate website or applications. While Microsoft has developed a patch to fix this issue, it is still up to the IT team to properly configure IIS so the problem can’t be created. Microsoft specifically stated that they do not provide presets and as such fixing the problem is more than just applying the patch,” said Justin Jett, Director of Audit and Compliance at Plixer.
“IT teams should use network traffic analytics to look at connections going to their IIS servers to determine if they have connections going to their web servers that could be creating these problems. Often these connections are long-lived or the source connection continuously repeats to trigger a problem on the server. By looking at these metrics, IT teams can identify the source of the DDoS. These types of problems can be resolved with proper configuration. Network traffic analytics can help you understand where there may be configuration issues so the system can be updated before there are major problems like DDoS attacks,” Jett added.
Related: Windows Kernel Vulnerability Exploited in Attacks
Related: Microsoft Patches Actively Exploited Windows Vulnerability
Related: Windows Zero-Day Exploited by New ‘SandCat’ Group
Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Omron Patches PLC, Engineering Software Flaws Discovered During ICS Malware Analysis
- Intel Launches New Attestation Service as Part of Trust Authority Portfolio
- Atos Unify Vulnerabilities Could Allow Hackers to Backdoor Systems
- SASE Firm Cato Networks Raises $238 Million at $3 Billion Valuation
- Clorox Blames Damaging Cyberattack for Product Shortage
- Trend Micro Patches Exploited Zero-Day Vulnerability in Endpoint Security Products
- CISA Says Owl Labs Vulnerabilities Requiring Close Physical Range Exploited in Attacks
- Cybersecurity M&A Roundup for First Half of September 2023
Latest News
- UK’s New Online Safety Law Adds to Crackdown on Big Tech Companies
- Critical Infrastructure Organizations Warned of Snatch Ransomware Attacks
- Omron Patches PLC, Engineering Software Flaws Discovered During ICS Malware Analysis
- MGM Resorts Computers Back Up After 10 Days as Analysts Eye Effects of Casino Cyberattacks
- Intel Launches New Attestation Service as Part of Trust Authority Portfolio
- Tor-Based Drug Marketplace Piilopuoti Shut Down by Law Enforcement
- Staying on Topic in an Off Topic World
- Discern Security Emerges From Stealth Mode With $3 Million in Funding
