CVE-2009-1536

LowCVSS 2.6/10Last modified Jun 16, 2026

Description

ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request scheduling, which allows remote attackers to cause a denial of service (daemon outage) via a series of crafted HTTP requests, aka "Remote Unauthenticated Denial of Service in ASP.NET Vulnerability."

Metrics

CVSS 2.0 2.6/10AV:N/AC:H/Au:N/C:N/I:N/A:P

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://blogs.technet.com/srd/archive/2009/08/11/ms09-035-asp-net-denial-of-service-vulnerability.aspxVendor Advisory
http://osvdb.org/56905Broken Link
http://secunia.com/advisories/36127Third Party Advisory
http://www.securityfocus.com/bid/35985Patch, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1022715Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA09-223A.htmlThird Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2009/2231Permissions Required, Third Party Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-036
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6393Third Party Advisory
http://blogs.technet.com/srd/archive/2009/08/11/ms09-035-asp-net-denial-of-service-vulnerability.aspxVendor Advisory
http://osvdb.org/56905Broken Link
http://secunia.com/advisories/36127Third Party Advisory
http://www.securityfocus.com/bid/35985Patch, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1022715Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA09-223A.htmlThird Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2009/2231Permissions Required, Third Party Advisory
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-036
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6393Third Party Advisory

Timeline

Published: Aug 12, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-15378.8Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows CVE-2009-15389.3The QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and CVE-2009-15399.3The QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and CVE-2009-15429.0The Virtual Machine Monitor (VMM) in Microsoft Virtual PC 2004 SP1, 2007, and 2007 SP1, and Microsoft Virtual Server 2005 R2 SP1, does not e CVE-2009-15448.8Double free vulnerability in the Workstation service in Microsoft Windows allows remote authenticated users to gain privileges via a crafted CVE-2009-15459.3Unspecified vulnerability in Avifil32.dll in the Windows Media file handling functionality in Microsoft Windows 2000 SP4, XP SP2 and SP3, Se CVE-2009-15468.5Integer overflow in Avifil32.dll in the Windows Media file handling functionality in Microsoft Windows allows remote attackers to execute ar CVE-2009-15478.8Unspecified vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via a c CVE-2009-15487.5SQL injection vulnerability in index.php in BluSky CMS allows remote attackers to execute arbitrary SQL commands via the news_id parameter i CVE-2009-15497.5AGTC MyShop 3.2b allows remote attackers to bypass authentication and obtain administrative access setting the log_accept cookie to "correct CVE-2009-15505.0Zakkis Technology ABC Advertise 1.0 does not properly restrict access to admin.inc.php, which allows remote attackers to obtain the administ CVE-2009-15517.5Multiple PHP remote file inclusion vulnerabilities in Qt quickteam 2 allow remote attackers to execute arbitrary PHP code via a URL in the (