The CERT Coordination Center (Computer Emergency Response Team) has issued a warning about a series of vulnerabilities in implementations of various application protocols that use the UDP protocol for transport. These vulnerabilities can be exploited to create denial-of-service attacks due to the potential for packet exchange loops between two hosts. For example, attackers can exhaust the available network bandwidth, disrupt the operation of network services (for instance, by generating high loads and exceeding request rate limits), and implement traffic amplifiers for DDoS attacks.
Among the protocols with vulnerable implementations are DNS, NTP, TFTP, Echo (RFC862), Chargen (RFC864), and QOTD (RFC865). The presence of the vulnerability (CVE-2024-2169) has been confirmed in specific products from companies such as Cisco, Microsoft, Broadcom, Brother, Honeywell (CVE-2024-1309), and MikroTik. As mitigation measures to block vulnerabilities, it is recommended to enable anti-spoofing (uRPF) on firewalls, limit access to unnecessary UDP services, and configure traffic rate limiting (rate-limit and QoS).
The vulnerabilities are due to the lack of protection against address spoofing in the UDP protocol — in the absence of anti-spoofing protections on transit routers, an attacker can specify any server's IP address in a UDP packet and send that packet to another server, which will return a response to the specified spoofed address. The attack method involves creating a situation where packets loop between servers that use vulnerable implementations of the protocol. For instance, in response to a received packet, the target server may send back an error code, and the server whose address was spoofed by the attacker will return its response, which, in turn, leads to yet another return of a packet with an error code. Thus, servers they will start playing packets back and forth in a 'ping-pong' manner indefinitely.
It is noteworthy that this type of attack method is not new and has server In 2009, one of the attack vectors on time synchronization using ntpd was eliminated (CVE-2009-3563) in versions 4.2.4p8 and 4.2.5. The attack involved sending an NTP packet with a spoofed address and a flagged mode of MODE_PRIVATE, which, when processed, caused the target server to respond that the private mode could not be used while leaving the MODE_PRIVATE flag still set. Consequently, another server could not process this flag and would return its own response, leading to a loop in packet exchange between the two NTP servers. A warning about the possibility of such an attack was published for the DNS protocol back in 1996.
Global scanning of internet addresses has revealed that there are currently at least 23,000 vulnerable TFTP servers, 63,000 DNS servers, 89,000 NTP servers, 56,000 Echo/RFC862 services, 22,000 Chargen/RFC864 services, and 21,000 QOTD/RFC865 services. It is assumed that the presence of unpatched vulnerabilities in NTP servers is related to the use of very old versions of ntpd released before 2010. Echo, Chargen, and QOTD services are inherently vulnerable due to their architecture. The situation with TFTP and DNS servers requires addressing with their administrators. Servers such as atftpd and tftpd are not affected by the issue since they use a random source port number when sending responses. Among the vulnerable DNS servers, dproxy-nexgen is mentioned. In Microsoft products, the issue manifests in WDS (Windows Deployment Services), and in Cisco products, the problem exists in router series 2800 and 2970.
Source: opennet.ru
