{"id":114452,"date":"2024-03-20T12:25:49","date_gmt":"2024-03-20T10:25:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami"},"modified":"2024-03-20T12:25:49","modified_gmt":"2024-03-20T10:25:49","slug":"ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami","title":{"rendered":"An attack on certain UDP-based protocols that leads to packet exchange looping.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

The CERT Coordination Center (Computer Emergency Response Team) has issued a warning about a series of vulnerabilities in implementations of various application protocols that use the UDP protocol for transport. These vulnerabilities can be exploited to create denial-of-service attacks due to the potential for packet exchange loops between two hosts. For example, attackers can exhaust the available network bandwidth, disrupt the operation of network services (for instance, by generating high loads and exceeding request rate limits), and implement traffic amplifiers for DDoS attacks. <\/p>\n

Among the protocols with vulnerable implementations are DNS, NTP, TFTP, Echo (RFC862), Chargen (RFC864), and QOTD (RFC865). The presence of the vulnerability (CVE-2024-2169) has been confirmed in specific products from companies such as Cisco, Microsoft, Broadcom, Brother, Honeywell (CVE-2024-1309), and MikroTik. As mitigation measures to block vulnerabilities, it is recommended to enable anti-spoofing (uRPF) on firewalls, limit access to unnecessary UDP services, and configure traffic rate limiting (rate-limit and QoS). <\/p>\n

Vulnerabilities stem from the lack of protection in the UDP protocol against address spoofing \u2014 when there is no anti-spoofing protection on transit routers, an attacker can specify any server's IP address in a UDP packet and send that packet to another server, which will return a response to the specified fake address. The attack method boils down to creating a situation where packets are looped between servers using vulnerable protocol implementations. For example, in response to a received packet, the target server may send a response with an error code, while the server whose address was spoofed by the attacker will return its response, which, in turn, will lead to the return of a packet with an error code again. Thus, servers<\/a> they will start playing a never-ending game of packet 'ping-pong.'

\"An<\/center> <\/p>\n

It is noteworthy that this type of attack method is not new and has server<\/a> In 2009, one of the attack vectors on time synchronization using ntpd was eliminated (CVE-2009-3563) in versions 4.2.4p8 and 4.2.5. The attack involved sending an NTP packet with a spoofed address and a flagged mode of MODE_PRIVATE, which, when processed, caused the target server to respond that the private mode could not be used while leaving the MODE_PRIVATE flag still set. Consequently, another server could not process this flag and would return its own response, leading to a loop in packet exchange between the two NTP servers. A warning about the possibility of such an attack was published for the DNS protocol back in 1996. <\/p>\n

Global scanning of internet addresses has revealed that there are currently at least 23,000 vulnerable TFTP servers, 63,000 DNS servers, 89,000 NTP servers, 56,000 Echo\/RFC862 services, 22,000 Chargen\/RFC864 services, and 21,000 QOTD\/RFC865 services. It is assumed that the presence of unpatched vulnerabilities in NTP servers is related to the use of very old versions of ntpd released before 2010. Echo, Chargen, and QOTD services are inherently vulnerable due to their architecture. The situation with TFTP and DNS servers requires addressing with their administrators. Servers such as atftpd and tftpd are not affected by the issue since they use a random source port number when sending responses. Among the vulnerable DNS servers, dproxy-nexgen is mentioned. In Microsoft products, the issue manifests in WDS (Windows Deployment Services), and in Cisco products, the problem exists in router series 2800 and 2970.
\n
Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043e\u0440\u0434\u0438\u043d\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 CERT (\u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0447\u0440\u0435\u0437\u0432\u044b\u0447\u0430\u0439\u043d\u044b\u0435 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043e \u0441\u0435\u0440\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u044b\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u0430 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b UDP. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043e\u0442\u043a\u0430\u0437\u0430 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0438\u0437-\u0437\u0430 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0437\u0430\u0446\u0438\u043a\u043b\u0438\u0432\u0430\u043d\u0438\u044f \u043e\u0431\u043c\u0435\u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 \u043c\u0435\u0436\u0434\u0443 \u0434\u0432\u0443\u043c\u044f \u0445\u043e\u0441\u0442\u0430\u043c\u0438. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u043c\u043e\u0433\u0443\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0438\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0439 \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u043d\u043e\u0439 \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0442\u0438, \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":114453,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-114452","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Attack on certain UDP-based protocols leading to a packet exchange loop | ProHoster","description":"The CERT Coordination Center (Computer Emergency Response Team) has published a warning about a series of vulnerabilities in implementations of various application protocols that use it as a transport.","canonical_url":"https:\/\/prohoster.info\/en\/blog\/news\/ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"en_US","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0430 \u043d\u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044b \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 UDP, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0430\u044f \u043a \u0437\u0430\u0446\u0438\u043a\u043b\u0438\u0432\u0430\u043d\u0438\u044e \u043e\u0431\u043c\u0435\u043d\u0430 \u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438 | ProHoster","og:description":"\u041a\u043e\u043e\u0440\u0434\u0438\u043d\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0439 \u0446\u0435\u043d\u0442\u0440 CERT (\u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043d\u0430\u044f \u0433\u0440\u0443\u043f\u043f\u0430 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0447\u0440\u0435\u0437\u0432\u044b\u0447\u0430\u0439\u043d\u044b\u0435 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u0438), \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043e \u0441\u0435\u0440\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044f\u0445 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u044b\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u0430.","og:url":"https:\/\/prohoster.info\/en\/blog\/news\/ataka-na-nekotorye-protokoly-na-osnove-udp-privodyashhaya-k-zacziklivaniyu-obmena-paketami","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-03-20T10:25:49+00:00","article:modified_time":"2024-03-20T10:25:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"114452","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 16:53:32","updated":"2026-02-09 21:37:58","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/114452","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/comments?post=114452"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/114452\/revisions"}],"predecessor-version":[{"id":159859,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/posts\/114452\/revisions\/159859"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media\/114453"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/media?parent=114452"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/categories?post=114452"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/en\/wp-json\/wp\/v2\/tags?post=114452"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}