Vulnerability Note VU#550620

Multicast DNS (mDNS) implementations may respond to unicast queries originating outside the local link

Original Release date: 31 三月 2015 | Last revised: 15 五月 2015

转自:http://www.kb.cert.org/vuls/id/550620

文中说得很明白,mdns的最大问题是允许广域网的mdns单播查询,这会暴露设备信息,或者被利用用于dns放大攻击。

解决方法:(1)考虑在WAN处屏蔽MDNS UDP端口5353的流量进入或离开,就是说不允许5353的mdns流量流入广域网。(2)禁用mDNS服务

 

Overview

Multicast DNS implementations may respond to unicast queries that originate from sources outside of the local link network. Such responses may disclose information about network devices or be used in denial-of-service (DoS) amplification attacks.

Description

Multicast DNS (mDNS) is a way for devices on a local link network to automatically discover other services and devices. In some implementations of mDNS, the mDNS server replies to unicast queries from outside the link local network (e.g., the WAN). This mDNS response may result in information disclosure of devices on the network. Furthermore, the information returned in the response is greater in size than the query and may be used for denial-of-service (DoS) amplification.

RFC 6762 Section 5.5 states the following:

"In specialized applications there may be rare situations where it
  makes sense for a Multicast DNS querier to send its query via unicast
  to a specific machine.  When a Multicast DNS responder receives a
  query via direct unicast, it SHOULD respond as it would for "QU"
  questions, as described above in Section 5.4.  
Since it is possible
  for a unicast query to be received from a machine outside the local
  link, responders SHOULD check that the source address in the query
  packet matches the local subnet for that link (or, in the case of
  IPv6, the source address has an on-link prefix) and silently ignore
  the packet if not.


   There may be specialized situations, outside the scope of this
  document, where it is intended and desirable to create a responder
  that does answer queries originating outside the local link.
"

While unicast queries originating from outside the local link are not specifically disallowed, RFC 6762 recommends to ignore any such packets. Some implementations of mDNS do however respond to unicast queries originating outside the local link, possibly for specialized use cases beyond the scope of RFC 6762.

In these circumstances, the mDNS response to a query from outside the local link allows for information disclosure about devices on the network, such as model number and operating system.

Additionally, the mDNS response to a query from outside the local link may be used for denial of service amplification attacks, due to the larger response size compared to the query size.

More information can be found in security researcher's blog.

Impact

An mDNS response to a unicast query originating outside of the local link network may result in information disclosure, such as disclosing the device type/model that responds to the request or the operating system running such software. The mDNS response may also be used to amplify denial of service attacks against other networks.

Solution

Block inbound and outbound mDNS on the WAN

If such mDNS behavior is not a requirement for your organization, consider blocking the mDNS UDP port 5353 from entering or leaving your local link network.

Disable mDNS services

Some software and devices may allow disabling of the mDNS services. Please consult with the vendor of your product.

Vendor Information (Learn More)

Despite attempts to analyze scan results, it is not entirely clear exactly which software responds to mDNS queries. Vendors have been alerted, but currently only a small number of devices have been confirmed to respond to unicast queries from the WAN. In Linux, the Avahi software is also known to allow unicast queries.

Listed below are vendors that are affected, in the sense that their software or devices by default can respond to unicast queries from outside the link local network. While this technically follows established RFCs and is not a vulnerability in the normal sense, for reasons outlined above this may be unwanted behavior. If you are aware of a software or device that responds to mDNS unicast queries from outside the local link, please contact us.

Vendor Status Date Notified Date Updated
Avahi mDNS Affected - 31 Mar 2015
Canon Affected 10 Feb 2015 08 Apr 2015
Hewlett-Packard Company Affected 10 Feb 2015 20 Mar 2015
IBM Corporation Affected 10 Feb 2015 31 Mar 2015
Synology Affected 10 Feb 2015 31 Mar 2015
Cisco Systems, Inc. Not Affected 10 Feb 2015 31 Mar 2015
Citrix Not Affected 10 Feb 2015 25 Mar 2015
D-Link Systems, Inc. Not Affected 10 Feb 2015 20 Mar 2015
F5 Networks, Inc. Not Affected 10 Feb 2015 31 Mar 2015
Microsoft Corporation Not Affected 10 Feb 2015 09 Mar 2015
Ricoh Company Ltd. Not Affected 10 Feb 2015 15 May 2015
Apple Unknown 10 Feb 2015 10 Feb 2015
CentOS Unknown 10 Feb 2015 10 Feb 2015
Debian GNU/Linux Unknown 10 Feb 2015 10 Feb 2015
Dell Computer Corporation, Inc. Unknown 10 Feb 2015 10 Feb 2015

If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

Group Score Vector
Base 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P
Temporal 5.2 E:POC/RL:W/RC:UR
Environmental 3.9 CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

MDNS的漏洞报告——mdns的最大问题是允许广域网的mdns单播查询,这会暴露设备信息,或者被利用用于dns放大攻击的更多相关文章

  1. MDNS DDoS 反射放大攻击——攻击者假冒被攻击者IP向网络发送DNS请求,域名为“_services._dns-sd._udp.local”,这将引起本地网络中所有提供服务的主机都向被攻击者IP发送DNS响应,列举网络中所有服务

    MDNS Reflection DDoS 2015年3月,有报告叙述了mDNS 成为反射式和放大式 DDoS 攻击中所用媒介的可能性,并详述了 mDNS 反射式攻击的原理和相应防御方式.Q3,Akam ...

  2. 【代码审计】ESPCMSP8(易思企业建站管理系统)漏洞报告

    0x00简介 项目名称:ESPCMS-P8(易思企业建站管理系统) 测试平台:Windwos 版本信息:P8.19082801稳定版 更新时间:2019-08-30 00:56:32 网站官网:htt ...

  3. 最常见的安全漏洞– Acunetix Web应用程序漏洞报告2021

    每年,Acunetix都会为您提供最常见的Web安全漏洞和网络外围漏洞的分析.我们的年度Web应用程序漏洞报告(现已成为Invicti AppSec指标的一部分)是基于从Acunetix在线获得的真实 ...

  4. 风炫安全web安全学习第三十三节课 文件包含漏洞基础以及利用伪协议进行攻击

    风炫安全web安全学习第三十三节课 文件包含漏洞基础以及利用伪协议进行攻击 文件包含漏洞 参考文章:https://chybeta.github.io/2017/10/08/php文件包含漏洞/ 分类 ...

  5. 可以通过shadowserver来查看开放的mdns(用以反射放大攻击)——中国的在 https://mdns.shadowserver.org/workstation/index.html

    Open mDNS Scanning Project 来自:https://mdns.shadowserver.org/ If you are looking at this page, then m ...

  6. 【独家】K8S漏洞报告|近期bug fix解读&1.11主要bug fix汇总

    内容提要: 1. 高危漏洞CVE-2018-1002105深度解读 2. 11/19--12/11 bug fix汇总分析 3. 1.11重要bug fix解读 4. 1.9重要bug fix解读 在 ...

  7. 【独家】K8S漏洞报告 | 近期bug fix解读

    安全漏洞CVE-2019-3874分析 Kubernetes近期重要bug fix分析 Kubernetes v1.13.5 bug fix数据分析 ——本周更新内容 安全漏洞CVE-2019-387 ...

  8. 【独家】K8S漏洞报告 | CVE-2019-1002101解读

    kubectl cp漏洞CVE-2019-1002101分析 Kube-proxy IPVS添加flag ipvs-strict-arp 近期bug fix数据分析 ——本期更新内容 kubectl ...

  9. K8S漏洞报告 | 近期bug fix解读&1.13主要bug fix汇总

    K8s近期漏洞详解 Kubernetes仪表盘漏洞(CVE-2018-18264) 因为这一漏洞,用户可以“跳过”登录过程获得仪表盘所使用的自定义TLS证书.如果您已将Kubernetes仪表盘配置为 ...

随机推荐

  1. explicit的用法

    http://blog.csdn.net/chollima/article/details/3486230

  2. Chrome插件Axure RP Extension

    Chrome插件Axure RP Extension 1.将文件夹“0.6.2_0”复制到Chrome文件夹中某个位置. 2.打开Chrome,打开[设置] - [扩展程序],勾选右上角的“开发者模式 ...

  3. 暑假NOIP期末考试【1】—— Phantom

    Phantom •题目名称: phantom •时间限制:1 秒 •空间限制:256 MiB 题目描写叙述 在一个无限大的棋盘上.排列着 n * n 枚棋子,形成一个 n 行 n 列的方阵.棋子能够横 ...

  4. 每天学点Python之comprehensions

    每天学点Python之comprehensions 推导式能够简化对数据的处理,让代码简洁的同一时候还具有非常高的可读性.这在Python中非经常见. 列表推导式 通过列表推导式能够对列表中的全部元素 ...

  5. yqj2065经典语录

    在上课时.博客中和<编程导论(Java)>书中,yqj2065说过一些简短的话.列举一些玩玩. 假设您在我的博客中看见好玩的,最好还是推荐一下. 持续加入中... 1. "噢姐姐 ...

  6. Android应用内加载pdf的方法?

    [可行] 最直接的方式下载到本地, 然后调用相关应用打开 [可行,有局限] 使用 webview 加载, 需要在 原url 前面加上 http://docs.google.com/gview?url= ...

  7. kafka的使用

    kafka基于zookeeper. 需要安装kafka.zookeeper. 安装方法参考:http://tzz6.iteye.com/blog/2401197 启动zookeeper:点击zkSer ...

  8. SpringBoot(三) SpringBoot中的日志配置

    SLF4J Spring Boot在所有内部日志中使用Commons Logging,但是默认配置也提供了对常用日志的支持,如:Java Util Logging,Log4J, Log4J2和Logb ...

  9. Android 对话框黑色边框的解决

    代码解决 : Dialog dialog = new Dialog(this); Window win = dialog.getWindow(); win.setBackgroundDrawableR ...

  10. PostgreSQL 事务管理的MVCC

    PostgreSQL的并发控制机制同时实现了多版本控制MVCC协议和两阶段封锁协议.实际采用哪种协议取决于所执行的语句类型. DML语句的并发控制将使用MVCC协议: DDL语句的并发控制基于标准的两 ...