CVE-2013-1305

HTTP.sys en Microsoft Windows v8, Windows Server 2012, y Windows RT permite a atacantes remotos causar una denegación de servicio (bucle infinito) mediante una cabecera HTTP especialmente diseñada, también conocido como "Vulnerabilidad de denegación de servicio de HTTP.sys"

This vulnerability allows remote attackers to cause a denial of service condition on vulnerable installations of IIS. No user interaction is required to exploit this vulnerability.
The specific flaw exists within handling of HTTP headers in the Windows kernel. By providing a duplicate of a particular header, an attacker is able to cause an infinite loop in the HTTP header parser. This will fully exhaust the resources of one processor on the vulnerable server and will prevent IIS from responding to any other requests.