MDNS的漏洞报告——mdns的最大问题是允许广域网的mdns单播查询,这会暴露设备信息,或者被利用用于dns放大攻击

本文涉及的产品
公共DNS(含HTTPDNS解析),每月1000万次HTTP解析
云解析 DNS,旗舰版 1个月
全局流量管理 GTM,标准版 1个月
简介:

Vulnerability Note VU#550620

Multicast DNS (mDNS) implementations may respond to unicast queries originating outside the local link

Original Release date: 31 三月 2015 | Last revised: 15 五月 2015

转自:http://www.kb.cert.org/vuls/id/550620

文中说得很明白,mdns的最大问题是允许广域网的mdns单播查询,这会暴露设备信息,或者被利用用于dns放大攻击。

解决方法:(1)考虑在WAN处屏蔽MDNS UDP端口5353的流量进入或离开,就是说不允许5353的mdns流量流入广域网。(2)禁用mDNS服务

 

 

Print Document

Overview

Multicast DNS implementations may respond to unicast queries that originate from sources outside of the local link network. Such responses may disclose information about network devices or be used in denial-of-service (DoS) amplification attacks.

Description

Multicast DNS (mDNS) is a way for devices on a local link network to automatically discover other services and devices. In some implementations of mDNS, the mDNS server replies to unicast queries from outside the link local network (e.g., the WAN). This mDNS response may result in information disclosure of devices on the network. Furthermore, the information returned in the response is greater in size than the query and may be used for denial-of-service (DoS) amplification.

RFC 6762 Section 5.5 states the following:

"In specialized applications there may be rare situations where it
  makes sense for a Multicast DNS querier to send its query via unicast
  to a specific machine.  When a Multicast DNS responder receives a
  query via direct unicast, it SHOULD respond as it would for "QU"
  questions, as described above in Section 5.4.  Since it is possible
  for a unicast query to be received from a machine outside the local
  link, responders SHOULD check that the source address in the query
  packet matches the local subnet for that link (or, in the case of
  IPv6, the source address has an on-link prefix) and silently ignore
  the packet if not.


   There may be specialized situations, outside the scope of this
  document, where it is intended and desirable to create a responder
  that does answer queries originating outside the local link.
"

While unicast queries originating from outside the local link are not specifically disallowed, RFC 6762 recommends to ignore any such packets. Some implementations of mDNS do however respond to unicast queries originating outside the local link, possibly for specialized use cases beyond the scope of RFC 6762. 

In these circumstances, the mDNS response to a query from outside the local link allows for information disclosure about devices on the network, such as model number and operating system.

Additionally, the mDNS response to a query from outside the local link may be used for denial of service amplification attacks, due to the larger response size compared to the query size.

More information can be found in security researcher's blog.

Impact

An mDNS response to a unicast query originating outside of the local link network may result in information disclosure, such as disclosing the device type/model that responds to the request or the operating system running such software. The mDNS response may also be used to amplify denial of service attacks against other networks.

Solution

Block inbound and outbound mDNS on the WAN

If such mDNS behavior is not a requirement for your organization, consider blocking the mDNS UDP port 5353 from entering or leaving your local link network.

Disable mDNS services

Some software and devices may allow disabling of the mDNS services. Please consult with the vendor of your product.

Vendor Information (Learn More)

Despite attempts to analyze scan results, it is not entirely clear exactly which software responds to mDNS queries. Vendors have been alerted, but currently only a small number of devices have been confirmed to respond to unicast queries from the WAN. In Linux, the Avahi software is also known to allow unicast queries.

Listed below are vendors that are affected, in the sense that their software or devices by default can respond to unicast queries from outside the link local network. While this technically follows established RFCs and is not a vulnerability in the normal sense, for reasons outlined above this may be unwanted behavior. If you are aware of a software or device that responds to mDNS unicast queries from outside the local link, please contact us.

Vendor Status Date Notified Date Updated
Avahi mDNS Affected - 31 Mar 2015
Canon Affected 10 Feb 2015 08 Apr 2015
Hewlett-Packard Company Affected 10 Feb 2015 20 Mar 2015
IBM Corporation Affected 10 Feb 2015 31 Mar 2015
Synology Affected 10 Feb 2015 31 Mar 2015
Cisco Systems, Inc. Not Affected 10 Feb 2015 31 Mar 2015
Citrix Not Affected 10 Feb 2015 25 Mar 2015
D-Link Systems, Inc. Not Affected 10 Feb 2015 20 Mar 2015
F5 Networks, Inc. Not Affected 10 Feb 2015 31 Mar 2015
Microsoft Corporation Not Affected 10 Feb 2015 09 Mar 2015
Ricoh Company Ltd. Not Affected 10 Feb 2015 15 May 2015
Apple Unknown 10 Feb 2015 10 Feb 2015
CentOS Unknown 10 Feb 2015 10 Feb 2015
Debian GNU/Linux Unknown 10 Feb 2015 10 Feb 2015
Dell Computer Corporation, Inc. Unknown 10 Feb 2015 10 Feb 2015
If you are a vendor and your product is affected, let us know.View More »

CVSS Metrics (Learn More)

Group Score Vector
Base 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P
Temporal 5.2 E:POC/RL:W/RC:UR
Environmental 3.9 CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References



















本文转自张昺华-sky博客园博客,原文链接:http://www.cnblogs.com/bonelee/p/7567934.html ,如需转载请自行联系原作者





相关文章
|
18天前
|
安全 算法 网络安全
网络安全的盾牌与剑:漏洞防御与加密技术解析
【9月更文挑战第21天】在数字世界的海洋中,网络安全是航行者的罗盘和船锚。本文将揭开网络安全漏洞的面纱,探讨如何通过加密技术筑起数据保护的堡垒,并强调安全意识的重要性。从基础概念到实际操作,我们将一同航行在网络安全的波涛之中,寻找安全的灯塔。
|
13天前
|
存储 Cloud Native 关系型数据库
Ganos实时热力聚合查询能力解析与最佳实践
Ganos是由阿里云数据库产品事业部与飞天实验室共同研发的新一代云原生位置智能引擎,集成于PolarDB-PG、Lindorm、AnalyticDB-PG和RDS-PG等核心产品中。Ganos拥有十大核心引擎,涵盖几何、栅格、轨迹等多种数据处理能力,实现了多模多态数据的一体化存储、查询与分析。本文重点介绍了Ganos的热力瓦片(HMT)技术,通过实时热力聚合查询与动态输出热力瓦片,无需预处理即可实现大规模数据秒级聚合与渲染,适用于交通、城市管理、共享出行等多个领域。HMT相比传统网格聚合技术具有高效、易用的优势,并已在多个真实场景中验证其卓越性能。
29 0
|
8天前
|
存储 安全 算法
网络安全的盾牌与利剑:漏洞防范与加密技术解析
【9月更文挑战第31天】在数字时代的浪潮中,网络安全成为守护个人隐私和组织资产的重要屏障。本文将深入探讨网络安全中的两大关键要素:安全漏洞和加密技术。我们将从漏洞的类型、检测方法到如何有效修补,逐一剖析;同时,对加密技术的基本原理、应用实例进行详细解读。文章旨在为读者提供一套实用的网络安全知识框架,帮助提升网络防护意识和技能,确保在日益复杂的网络环境中保护好每一份数据。
21 3
|
10天前
|
域名解析 网络协议 安全
DNS查询工具简介
DNS查询工具简介
27 4
|
19天前
|
SQL 存储 安全
网络安全与信息安全:从漏洞到防护的全方位解析
【9月更文挑战第20天】在数字化时代,网络安全和信息安全的重要性日益凸显。本文将深入探讨网络安全的多个方面,包括常见的安全漏洞、加密技术的应用以及提升个人安全意识的方法。我们将通过实例分析,揭示网络攻击者如何利用安全漏洞进行入侵,同时展示如何使用加密技术保护数据安全。此外,我们还将讨论如何通过教育和实践提高大众的安全意识,以减少安全威胁的发生。文章旨在为读者提供一套全面的网络安全知识体系,帮助他们在日益复杂的网络环境中保护自己的信息资产。
|
14天前
|
存储 供应链 安全
守护网络前线:漏洞、加密与安全意识的全方位解析
在这个数字时代,网络安全已成为我们不可忽视的重要议题。本文深入探讨了网络安全中的三大关键领域:安全漏洞、加密技术以及安全意识。通过具体案例和实用策略,旨在为读者提供一个全面而深入的视角,以更好地理解和应对网络安全挑战。
|
16天前
|
安全 算法 网络安全
网络安全的守护神:漏洞防御与加密技术的深度解析
【9月更文挑战第23天】在数字时代的浪潮中,信息安全已成为我们不可忽视的重要课题。本文旨在深入探讨网络安全的两大支柱——漏洞防御和加密技术,揭示其背后的原理及应用。通过分析近期的安全事件,我们将理解安全意识的重要性,并学习如何通过技术和策略保护自己的数字资产。文章不仅提供理论知识,还将分享实用的安全建议,助您在网络世界中更安全地航行。
36 4
|
16天前
|
SQL 安全 算法
网络安全与信息安全的全方位解析:从漏洞识别到加密技术,再到安全意识的培养
在这个数字时代,网络安全和信息安全已成为企业和个人不可忽视的关键要素。本文深入探讨了网络安全的基本概念、常见漏洞类型及其影响,并详细介绍了当前主流的加密技术。同时,文章还强调了提升安全意识的重要性,提供了实用的安全策略建议。通过综合分析,本文旨在为读者提供一个清晰的网络安全与信息安全知识框架,帮助大家更好地防范潜在的网络威胁,保护个人和组织的数据安全。
|
17天前
|
安全 算法 网络安全
网络安全的盾牌与矛:漏洞防御与加密技术解析
【9月更文挑战第22天】在数字世界的棋盘上,网络安全是一场没有硝烟的战争。本文旨在揭示网络攻击的常见手段和防御策略,探讨如何通过提升安全意识和应用加密技术来保护信息安全。我们将从网络安全漏洞的类型、成因讲起,进而分析加密技术的原理与实践,最后强调培养良好的安全习惯的重要性。文章将用浅显的语言和生动的比喻,带领读者走进网络安全的世界,理解其复杂性并掌握基本防护知识。
|
16天前
|
存储 安全 算法
网络安全与信息安全:构建数字世界的坚固防线在数字化浪潮席卷全球的今天,网络安全与信息安全已成为维系社会秩序、保障个人隐私与企业机密的关键防线。本文旨在深入探讨网络安全漏洞的成因与影响,解析加密技术如何筑起数据安全的屏障,并强调提升公众安全意识的重要性,共同绘制一幅数字时代安全防护的蓝图。
本文聚焦网络安全与信息安全领域,通过剖析网络安全漏洞的多样形态及其背后成因,揭示其对个人、企业乃至国家安全的潜在威胁。随后,详细阐述了加密技术的原理、分类及应用,展现其在保护数据安全方面的核心作用。最后,强调了提升全民网络安全意识的紧迫性,提出具体策略与建议,旨在构建一个更加安全、可靠的数字环境。

相关产品

  • 云解析DNS
  • 推荐镜像

    更多