If you can read this, either the style sheet didn't load or you have an older browser that doesn't support style sheets. Try clearing your browser cache and refreshing the page.

(The Register) Scary Microsoft announces ASP.NET zero-day vulnerability. What a pain in the ASP   (theregister.co.uk) divider line 22
More: Scary, Microsoft, ASP, distributed denial-of-service, worldwide web  
•       •       •

1767 clicks; posted to Geek » on 29 Dec 2011 at 4:06 PM   |  Favorite    |   share:  Share on Twitter share via Email Share on Facebook   more»   |    Get this fabulous T-Shirt and impress the methane out of your friends! shirt it!



22 Comments   (+0 »)
   
View Voting Results: Smartest and Funniest
 
IC Stars
2011-12-29 04:13:31 PM
This is affecting Tomcat and likely other web servers too.
 
ZAZ [TotalFark]
2011-12-29 04:26:29 PM
Programming in OCaml I got into the arguably bad habit of using the Map module instead of Hashtbl. In some cases it has O(lg N) behavior instead of running in constant time. On the other hand, it can't be defeated or degraded to O(N) by hash collisions.
 
Fish in a Barrel
2011-12-29 04:27:14 PM
IC Stars: This is affecting Tomcat and likely other web servers too.

Yeah, it's actually easier to make a list of servers that aren't affected. Pretty much anything not written in PERL, from what I understand.
 
ZAZ [TotalFark]
2011-12-29 04:34:06 PM
Fish in a Barrel

Are the form fields going into a hash table indexed by key? Does the attack use a different form for each server code base?
 
MrEricSir
2011-12-29 04:45:46 PM
IC Stars: This is affecting Tomcat and likely other web servers too.

I'm mostly familiar with Apache, but isn't setting a limit to the size of a request considered standard practice?
 
Deveyn [TotalFark]
2011-12-29 04:50:38 PM
MrEricSir: but isn't setting a limit to the size of a request considered standard practice?

Our web firewall already does that. I set it up because of form spammers.
 
the_sidewinder [TotalFark]
2011-12-29 04:51:37 PM
Contrary to the article, Paul Thurrott says that MS has already released a patch (new window)
 
Jormungandr
2011-12-29 04:59:36 PM
If you got web problems I feel for you, son /
I got 99 problems but ASP ain't one.
 
downstairs [TotalFark]
2011-12-29 05:25:03 PM
MrEricSir: I'm mostly familiar with Apache, but isn't setting a limit to the size of a request considered standard practice?

As well, isn't it limited by default? And its pretty low. For some applications I've had to increase it in IIS.
 
IC Stars
2011-12-29 05:33:49 PM
downstairs: MrEricSir: I'm mostly familiar with Apache, but isn't setting a limit to the size of a request considered standard practice?

As well, isn't it limited by default? And its pretty low. For some applications I've had to increase it in IIS.

Turns out, with all but the latest versions of Apache Tomcat, the maxHttpHeaderSize directive does have a default value, but was ignored.
 
lordargent
2011-12-29 05:40:55 PM
Fish in a Barrel : Yeah, it's actually easier to make a list of servers that aren't affected. Pretty much anything not written in PERL, from what I understand.

if ($ENV{'CONTENT_LENGTH'} > $config{'MAX_CONTENT_LENGTH'}) {die "Content Length longer than max. Suck it."}

/pseudocode, typed from what I can remember of the perl web libraries

/used to write a ton of web based perl app, many of them are still running even though I haven't supported them for 5 years.
 
downstairs [TotalFark]
2011-12-29 05:49:22 PM
IC Stars: Turns out, with all but the latest versions of Apache Tomcat, the maxHttpHeaderSize directive does have a default value, but was ignored.

Ahhhh. Well I was speaking of IIS, and I'm positive its default (at least it was in 6.0) because I've run into issues with it (attempting large uploads.)
 
Marine1
2011-12-29 06:10:08 PM
It's threads like this (with you damned ultra nerds discussing advanced programming techniques) that make me wonder if I could really do a BS IT degree.

/thanks for the confidence lowering, poopy heads.
 
the_sidewinder [TotalFark]
2011-12-29 06:19:04 PM
Marine1: It's threads like this (with you damned ultra nerds discussing advanced programming techniques) that make me wonder if I could really do a BS IT degree.

/thanks for the confidence lowering, poopy heads.

It's not as hard as it sounds
 
downstairs [TotalFark]
2011-12-29 06:29:48 PM
Marine1: It's threads like this (with you damned ultra nerds discussing advanced programming techniques) that make me wonder if I could really do a BS IT degree.

/thanks for the confidence lowering, poopy heads.

I dunno, I think the bottom is really falling out of the industry. Where once it was a rare skill that paid thusly, its now not all that hard to find even American workers to do IT work at 10% of what it used to pay.

Not even to mention outsourcing.
 
PainInTheASP [TotalFark]
2011-12-29 06:39:00 PM
I didn't do it! I was at the movies--I swear!
 
MusicMakeMyHeadPound
2011-12-29 06:39:09 PM
Marine1: It's threads like this (with you damned ultra nerds discussing advanced programming techniques) that make me wonder if I could really do a BS IT degree.

/thanks for the confidence lowering, poopy heads.

Meh. That comes with experience.

Mostly you learn from doing it, having something weird happen after you thought it was working just fine, then obsessing about it for a day or two until you reach a glorious eureeka moment that you can't share with anyone else (because their eyes will just glaze over and/or assess the best possible escape routes away from you). You'll begin to understand what's actually happening in the machine and the cycle continues until you eventually achieve mastery.

That shouldn't lower your confidence. What might lower your confidence is finding an IT job that requires less than 5 - 7 years of experience.

More helpfully: You should call up local businesses and ask to schedule courtesy interviews while you're still in school. Pop that awkward cherry early. It'll put you head and shoulders over potential candidates in the future too.
 
Phil McKraken
2011-12-29 07:07:46 PM
Marine1: It's threads like this (with you damned ultra nerds discussing advanced programming techniques) that make me wonder if I could really do a BS IT degree.

/thanks for the confidence lowering, poopy heads.

I have a CS degree and I understand fully the dialog in the article and here. What's mind boggling is the fact that someone found this vulnerability.
 
myinternetname
2011-12-29 07:59:23 PM
To hell with Microsoft. I reinstalled Vista last week and though I never use IE, wanted to update it from 7 to 9.

They wanted me to use Windows Update, which decided to stop working when I tried installing SP1. No thanks, I'm not locking my shiat up and restarting 3 times just to get back where I am right now.
 
ZAZ [TotalFark]
2011-12-29 08:00:15 PM
What's mind boggling is the fact that someone found this vulnerability.

In the early 1990s MIT's mail server crashed in an unusual way.

The master account and list server updated sendmail's "aliases" file. Sendmail 5 kept a hashed version of the aliases file on disk. It rebuilt the binary file when the text version changed. It got a hash collision and applied the standard recovery technique: double the table size and rebuild (basically using one more bit of the hash). It got another hash collision. Repeat until the disk file size limit for 4.3 BSD was exceeded.
 
DrippinBalls [TotalFark]
2011-12-29 08:21:41 PM
Too lazy. Python & PHP.
 
lordargent
2011-12-29 08:40:32 PM
Phil McKraken: I have a CS degree and I understand fully the dialog in the article and here. What's mind boggling is the fact that someone found this vulnerability.

It's a common cracking technique (push more data than ever expected, see if something breaks).

Especially since a lot of "Web Developers (TM)", only do bounds checking on the client side.

//

At one point in my career, I was the code review/validation guy. I used to craft evil stuff in perl (mostly using libwww), then webdeveloper toolbar for firefox came out, and some stuff became ridiculously easy.

Sooo, you set that HTML input box to only accept 50 characters? Well let me just remove that with webdeveloper toolbar and see what happens if I stuff 200 characters in there.

Ohh, you have a pull down box, let me use webdeveloper toolbar to convert it to an input box, you ARE checking the values you get on the server side, RIGHT!?

Let's see what happens when I remove the default selection in a radio selection group.

/hates that FARK modifies your post on preview and removes "broken" image links. Then disables the add comment button when you go back a page. No worries, WDT -> Enable Form Fields :P
 
Displayed 22 of 22 comments

View Voting Results: Smartest and Funniest

Redisplay/refresh comments

This thread is closed to new comments.

Continue Farking
Submit a Link »
 


Link here