MS16-049: Security Update for HTTP.sys (3148795)

High Nessus Plugin ID 90442


The remote Windows host is affected by a denial of service vulnerability.


The remote Windows host is missing a security update. It is, therefore, affected by a denial of service vulnerability in the HTTP 2.0 protocol stack (HTTP.sys) due to improper parsing of HTTP 2.0 requests. An unauthenticated, remote attacker can exploit this vulnerability, via a specially crafted HTTP packet, to cause the system to become unresponsive, resulting in a denial of service condition.


Microsoft has released a set of patches for Windows 10.

See Also

Plugin Details

Severity: High

ID: 90442

File Name: smb_nt_ms16-049.nasl

Version: $Revision: 1.5 $

Type: local

Agent: windows

Published: 2016/04/12

Modified: 2017/07/12

Dependencies: 57033, 13855

Risk Information

Risk Factor: High


Base Score: 7.8

Temporal Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

Temporal Vector: CVSS2#E:F/RL:OF/RC:ND

Vulnerability Information

CPE: cpe:/o:microsoft:windows

Required KB Items: SMB/MS_Bulletin_Checks/Possible

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2016/04/12

Vulnerability Publication Date: 2016/04/12

Reference Information

CVE: CVE-2016-0150

BID: 85908

OSVDB: 136978

MSFT: MS16-049

MSKB: 3147461, 3147458

IAVB: 2016-B-0066