MDNS spoofing
Description
The configuration of the MDNS services allows an attacker to spoof IP addresses effectively hijacking them or causing a denial-of-service. Alternatively, due to a lack of certain security measures, it is possible to intercept requests to mDNS services and obtain information about the connected devices.
Impact
Attack vector because it is possible to extract administrative credentials from the process cache.
Recommendation
Disable LLMR and NBT-NS. Configure the firewall to filter incoming connections from UDP 5353 port.
Threat
Anonymous attacker from local network.
Expected Remediation Time
⌚ 60 minutes.
Score
Default score using CVSS 3.1. It may change depending on the context of the src.
Base
- Attack vector: N
- Attack complexity: L
- Privileges required: L
- User interaction: N
- Scope: C
- Confidentiality: L
- Integrity: L
- Availability: N
Temporal
- Exploit code maturity: P
- Remediation level: T
- Report confidence: X
Result
- Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N/E:P/RL:T/RC:X
- Score:
- Base: 6.4
- Temporal: 5.8
- Severity:
- Base: Medium
- Temporal: Medium
Score 4.0
Default score using CVSS 4.0. It may change depending on the context of the src.
Base 4.0
- Attack vector: N
- Attack complexity: L
- Attack Requirements: N
- Privileges required: L
- User interaction: N
- Confidentiality (VC): L
- Integrity (VI): L
- Availability (VA): N
- Confidentiality (SC): L
- Integrity (SI): L
- Availability (SA): L
Threat 4.0
- Exploit maturity: P
Result 4.0
- Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L/E:P
- Score:
- CVSS-BT: 2.1
- Severity:
- CVSS-BT: Low
Compliant code
Verify that the application does not allow LLMNR and NBT-NS
gateway: "My gateway name"
firewall_service:
enabled: true
policy: 'drop'
log_default_action: true
firewall_rules:
- :id: '1'
:enabled: true
:description: 'disallow_connections'
:policy: 'disallow'
:destination_port_range: '5353'
:destination_ip: '00.01.02.03'
:source_port_range: '5353'
:source_ip: 'Any'
Non compliant code
Network configuration that allows LLMNR
gateway: "My gateway name"
firewall_service:
enabled: true
policy: 'drop'
log_default_action: true
firewall_rules:
- :id: '1'
:enabled: true
:llmnr: true
:destination_port_range: '5353'
:destination_ip: '00.01.02.03'
:source_port_range: '5353'
:source_ip: 'Any'
Requirements
Fixes
