How was the hash collision issue in ASP.NET fixed (MS11-100)? [closed]

Question

As reported by Slashdot, MS issued an update to ASP.NET to fix the hash collision attack today. (Listed as "Collisions in HashTable May Cause DoS Vulnerability - CVE-2011-3414" on the linked Technet page.)

The problem is that the POST data are converted into a hash table that uses a known hashing algorithm. And if an attacker uses this by crafting a request that contains lots of collisions, he can easily cause a Denial of Service.

Does anyone know how exactly does that update fix the issue?

Fiore

I would expect that they just used a better hash algorithm, but I'm not sure and haven't seen any details anywhere. – Davenport

Could also be they introduced some random parameter into the algorithm. – Quatrefoil

this might help you ....<weblogs.asp.net/scottgu/archive/2011/12/28/…> – Contend

@salman That page does not describe how the issue was fixed, only that a patch is available. – Stonedeaf

I don't understand why this is closed as a question that is not constructive. The question could be perfectly answered using facts and references. Maybe all relevant facts are not yet publically known, but that isn't a reason to close the question, or is it? – Scroop

Here is a proposed solution: #8697218 – Cornelia

Answer 1

The update is not a complete fix, but rather a workaround. It limits the number of POST parameters accepted.

Arrowworm

How did you find that out? Do you have some source? – Fiore

Guys that presented this vulnerability gave this information. – Catechumen

@Peri and where did they do that? – Fiore

Here are the slides events.ccc.de/congress/2011/Fahrplan/events/4680.en.html and here is the video mirror.fem-net.de/CCC/28C3/mp4-h264-HQ/… – Catechumen

The will be a update, but for now we can use the solution proposed here #8697218 – Cornelia

Better to use this solution if you need to workaround the limitation: <add key="aspnet:MaxHttpCollectionKeys" value="2000" /> to your appSettings in web.config. – Tanning