Microsoft flags IIS flaw that could lead to 100% CPU usage spikes when exploited

The DoS vulnerability involves sending malicious HTTP/2 connections that can slow down or freeze users' systems

Photo of a Microsoft building with clouds in view

Microsoft has released a security alert outlining a vulnerability with its web server technology that, if exploited, could block or slow down the entire system.

The denial of service (DoS) issue, first detected by F5 Networks' Gal Goldshtein, affects HTTP/2 connections to the Microsoft's Internet Information Services (IIS) platform, built for use with the Windows NT operating system.

Malicious HTTP/2 requests can be sent to a Windows Server running IIS, which would lead to the systems CPU usage to spike to 100% until the malicious connections are killed by IIS, the firm outlined in its advisory published yesterday.

"The HTTP/2 specification allows clients to specify any number of SETTINGS frames with any number of SETTINGS parameters," the security alert said.

"In some situations, excessive settings can cause services to become unstable and may result in a temporary CPU usage spike until the connection timeout is reached and the connection is closed."

Microsoft has not identified any mitigations or workaround as of yet, but are advising users to install a February 'non-security update', and review a 'knowledge base article', which at the time of writing links to a 404 page-not-found error message.

The firm has also attempted to mitigate the vulnerability by giving users the functionality to define thresholds on settings parameters included in an HTTP/2 request.

After patching their systems with recently-released cumulative updates, Microsoft added, system administrators can customise the HTTP/2 settings threshold and prevent the bug from slowing down or blocking their IIS web services.

Microsoft has had to contend with a number of high profile vulnerabilities recently, especially during the rollout of major upgrades to its Windows 10 operating system. This has led to the firm already commencing early beta testing for a major update due in 2020, much earlier than the process would normally begin.

Featured Resources

Humility in AI: Building trustworthy and ethical AI systems

How humble AI can help safeguard your business

Download now

Future of video conferencing

Optimising video conferencing features to achieve business goals

Download now

Leadership compass: Privileged Access Management

Securing privileged accounts in a high-risk environment

Download now

Why you need to include the cloud in your disaster recovery plan

Preserving data for business success

Download now

Recommended

Microsoft Defender for Identity can now detect Zerologon exploits
Security

Microsoft Defender for Identity can now detect Zerologon exploits

1 Dec 2020
What is AES encryption?
Advanced Encryption Standard (AES)

What is AES encryption?

30 Nov 2020
UK's Huawei 5G ban brought forward to September 2021
Security

UK's Huawei 5G ban brought forward to September 2021

30 Nov 2020
Hacker claims to be selling C-suite executives' Microsoft credentials
Security

Hacker claims to be selling C-suite executives' Microsoft credentials

30 Nov 2020

Most Popular

46 million Animal Jam accounts leaked after comms software breach
Security

46 million Animal Jam accounts leaked after comms software breach

13 Nov 2020
macOS Big Sur is bricking some older MacBooks
operating systems

macOS Big Sur is bricking some older MacBooks

16 Nov 2020
Huawei Mate 40 Pro 5G review: A tragically brilliant Mate
Mobile Phones

Huawei Mate 40 Pro 5G review: A tragically brilliant Mate

26 Nov 2020