Skip to main content

MDNS spoofing

Description​

The configuration of the MDNS services allows an attacker to spoof IP addresses effectively hijacking them or causing a denial-of-service. Alternatively, due to a lack of certain security measures, it is possible to intercept requests to mDNS services and obtain information about the connected devices.

Impact​

Attack vector because it is possible to extract administrative credentials from the process cache.

Recommendation​

Disable LLMR and NBT-NS. Configure the firewall to filter incoming connections from UDP 5353 port.

Threat​

Anonymous attacker from local network.

Expected Remediation Time​

⌚ 60 minutes.

Score​

Default score using CVSS 3.1. It may change depending on the context of the src.

Base​

  • Attack vector: N
  • Attack complexity: L
  • Privileges required: L
  • User interaction: N
  • Scope: C
  • Confidentiality: L
  • Integrity: L
  • Availability: N

Temporal​

  • Exploit code maturity: P
  • Remediation level: T
  • Report confidence: X

Result​

  • Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N/E:P/RL:T/RC:X
  • Score:
    • Base: 6.4
    • Temporal: 5.8
  • Severity:
    • Base: Medium
    • Temporal: Medium

Score 4.0​

Default score using CVSS 4.0 . It may change depending on the context of the src.

Base 4.0​

  • Attack vector: N
  • Attack complexity: L
  • Attack Requirements: N
  • Privileges required: L
  • User interaction: N
  • Confidentiality (VC): L
  • Integrity (VI): L
  • Availability (VA): N
  • Confidentiality (SC): L
  • Integrity (SI): L
  • Availability (SA): L

Threat 4.0​

  • Exploit maturity: P

Result 4.0​

  • Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:L/E:P
  • Score:
    • CVSS-BT: 2.1
  • Severity:
    • CVSS-BT: Low

Compliant code​

Verify that the application does not allow LLMNR and NBT-NS

gateway: "My gateway name"
firewall_service:
  enabled: true
  policy: 'drop'
  log_default_action: true
  firewall_rules:
  - :id: '1'
    :enabled: true
    :description: 'disallow_connections'
    :policy: 'disallow'
    :destination_port_range: '5353'
    :destination_ip: '00.01.02.03'
    :source_port_range: '5353'
    :source_ip: 'Any'

Non compliant code​

Network configuration that allows LLMNR

gateway: "My gateway name"
firewall_service:
  enabled: true
  policy: 'drop'
  log_default_action: true
  firewall_rules:
  - :id: '1'
    :enabled: true
    :llmnr: true
    :destination_port_range: '5353'
    :destination_ip: '00.01.02.03'
    :source_port_range: '5353'
    :source_ip: 'Any'

Requirements​

Fixes​

free trial

Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.

Last updated on