Flaw in web app frameworks pushes Microsoft to patch ASP.net promptly

The way many web app frameworks handle hashes makes them vulnerable to a denial-of-service attack, researchers revealed

By , IDG News Service |  Software

Web application platform developers had plenty of warning of the problem, according to Klink and Wälde: The attack was described as long ago as 2003, they said, in the Usenix Security paper "Denial of Service via Algorithmic Complexity Attacks" by Scott A. Crosby and Dan S. Wallach.

Changes were made to Perl that year to randomize the way hashes are calculated, preventing attackers from calculating collisions ahead of time, and similar changes were subsequently made to CRuby from version 1.9, they said.

Peter Sayer covers open source software, European intellectual property legislation and general technology breaking news for IDG News Service. Send comments and news tips to Peter at peter_sayer@idg.com.

Join us:
Facebook

Twitter

Pinterest

Tumblr

LinkedIn

Google+

Answers - Powered by ITworld

ITworld Answers helps you solve problems and share expertise. Ask a question or take a crack at answering the new questions below.

Ask a Question