CVE-2024-38067: Windows Server 2008 OCSP DOS Vulnerability

CVE-2024-38067 Overview

CVE-2024-38067 is a denial-of-service vulnerability affecting the Windows Online Certificate Status Protocol (OCSP) Server role across multiple Windows Server editions. An unauthenticated remote attacker can send crafted requests over the network to exhaust resources on the OCSP responder, disrupting certificate revocation checking for clients that rely on it. The flaw is classified under [CWE-400] Uncontrolled Resource Consumption.

Microsoft published the advisory on July 9, 2024, as part of its monthly security update cycle. The vulnerability requires no privileges and no user interaction, and it impacts confidentiality and integrity only indirectly through the loss of revocation services.

Critical Impact
A successful attack disables OCSP responses, preventing relying parties from validating certificate revocation status and degrading public key infrastructure (PKI) trust decisions across the enterprise.

Affected Products

Microsoft Windows Server 2008 SP2 and Windows Server 2008 R2 SP1 (x64)
Microsoft Windows Server 2012 and Windows Server 2012 R2
Microsoft Windows Server 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

2024-07-09 - CVE-2024-38067 published to NVD and Microsoft releases security patch
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-38067

Vulnerability Analysis

The Windows OCSP Server role responds to certificate status queries defined in RFC 6960. Clients submit OCSP requests over HTTP, and the responder signs replies indicating whether a certificate is good, revoked, or unknown. CVE-2024-38067 allows a remote attacker to overwhelm this service by sending requests that trigger disproportionate resource consumption on the responder.

The vulnerability is reachable from any network endpoint that can connect to the OCSP responder, which is typically published on the public internet so that external relying parties can validate enterprise-issued certificates. Exploitation does not require authentication, valid certificates, or user interaction.

While Microsoft has not released exploit code details, the EPSS model places this CVE in the 90th percentile for likelihood of exploitation, indicating elevated risk relative to the broader CVE population.

Root Cause

The root cause is uncontrolled resource consumption [CWE-400] in the OCSP request handling path. The responder processes incoming requests without sufficient bounds on the work performed per request or per connection, allowing an attacker to amplify their input into excessive CPU, memory, or thread utilization on the server.

Attack Vector

Attackers send a sustained stream of crafted OCSP requests to the public HTTP endpoint exposed by the Windows OCSP responder. Because the role is designed to be reachable by any client validating a certificate chain, network exposure is intrinsic to the deployment. Successful exploitation stops legitimate clients from retrieving revocation status, which can cascade into TLS handshake failures, code signing validation errors, and smart card logon disruption depending on relying party configuration.

No verified proof-of-concept code has been published for this CVE. Refer to the Microsoft Security Update CVE-2024-38067 advisory for vendor technical details.

Detection Methods for CVE-2024-38067

Indicators of Compromise

Sudden spikes in CPU, memory, or worker thread usage on hosts running the Active Directory Certificate Services Online Responder role.
Increased HTTP 5xx responses or connection timeouts from the /ocsp virtual directory in IIS logs.
High volumes of inbound OCSP requests from a narrow set of source IP addresses or from anomalous geographic regions.
Relying party telemetry showing OCSP fetch failures or fallback to cached or stapled responses.

Detection Strategies

Baseline normal OCSP request rates and alert when traffic deviates significantly from historical norms.
Correlate IIS access logs on the OCSP responder with Windows performance counters to identify resource exhaustion patterns.
Monitor Windows Event Log sources Microsoft-Windows-OnlineResponder and Microsoft-Windows-CertificationAuthority for service errors, restarts, or queue saturation events.

Monitoring Recommendations

Forward IIS, Online Responder, and Windows performance counter data to a centralized analytics platform for trend analysis.
Track downstream TLS clients for revocation check failures, which often surface a DoS condition before the responder itself alarms.
Configure synthetic OCSP probes from multiple network vantage points to detect availability degradation in real time.

How to Mitigate CVE-2024-38067

Immediate Actions Required

Apply the July 2024 Microsoft security updates to every Windows Server host running the Online Responder role.
Inventory all public-facing OCSP endpoints and confirm they map to fully patched servers.
Place rate limiting or a web application firewall (WAF) in front of the OCSP responder to cap requests per source IP.
Enable OCSP response stapling on TLS servers so that clients depend less on direct responder availability.

Patch Information

Microsoft addressed CVE-2024-38067 in the July 9, 2024 security updates. Administrators should consult the Microsoft Security Update CVE-2024-38067 advisory for the specific KB articles and cumulative update package identifiers that apply to each affected Windows Server version.

Workarounds

Restrict inbound access to the OCSP responder using network ACLs or reverse proxies that enforce per-client request quotas.
Deploy a content delivery network (CDN) or caching proxy in front of the responder to absorb repeated identical requests.
Scale the Online Responder Array horizontally so that load can be distributed across multiple nodes during traffic surges.
Where feasible, configure relying parties to use OCSP stapling or cached CRLs to reduce dependence on live responder availability.

bash

# Example: enforce per-IP rate limiting on the OCSP virtual directory in IIS
Import-Module WebAdministration
Set-WebConfigurationProperty -Filter "/system.webServer/security/dynamicIpSecurity/denyByRequestRate" `
  -Name "enabled" -Value "True" -PSPath "IIS:\Sites\Default Web Site\ocsp"
Set-WebConfigurationProperty -Filter "/system.webServer/security/dynamicIpSecurity/denyByRequestRate" `
  -Name "maxRequests" -Value 30 -PSPath "IIS:\Sites\Default Web Site\ocsp"
Set-WebConfigurationProperty -Filter "/system.webServer/security/dynamicIpSecurity/denyByRequestRate" `
  -Name "requestIntervalInMilliseconds" -Value 1000 -PSPath "IIS:\Sites\Default Web Site\ocsp"