How to remediate – ICMP Node Information Query Information Disclosure

1. Introduction

The ICMP Node Information Query vulnerability allows attackers to gather information about a remote host’s network configuration. This can help them map out your network and potentially bypass security controls. Systems running any operating system that responds to ICMPv6 Node Information Queries are usually affected, including servers, workstations, and network devices. A successful exploit could lead to reconnaissance of internal network architecture, impacting confidentiality.

2. Technical Explanation

The vulnerability occurs because the host answers to ICMPv6 Node Information Query messages (type 139) by disclosing its DNS name, IPv4 addresses and IPv6 addresses. An attacker can send these queries to discover details about a target network without authentication. This information is then used for network mapping.

• Root cause: The remote host responds to unsolicited ICMPv6 Node Information Queries.
• Exploit mechanism: An attacker sends an ICMPv6 Node Information Query message to the target host and analyzes the response. For example, using `ping6 -I -n 1 ` with a crafted packet type of 139.
• Scope: All systems responding to ICMPv6 Node Information Queries are affected.

3. Detection and Assessment

You can confirm if your system is vulnerable by checking its response to an ICMPv6 Node Information Query. A thorough method involves capturing network traffic during a query.

• Quick checks: Use the `ping6` command with the `-n` option to send a single query and observe the response.
• Scanning: Nmap can be used with the script `icmp-info`. Example: `nmap -sZ `.
• Logs and evidence: Network traffic captures (using Wireshark or tcpdump) will show ICMPv6 messages of type 139 if the host is responding.

ping6 -I eth0 -n 1 ::1

4. Solution / Remediation Steps

To fix this issue, reconfigure your system to stop answering ICMPv6 Node Information Queries or block these requests at the firewall.

4.1 Preparation

• Ensure you have console access in case of connectivity issues. Roll back by reverting to the previous snapshot.
• A change window is recommended, and approval from the network team may be required.

4.2 Implementation

1. Step 1: Block ICMP packets of type 139 using your firewall ruleset.
2. Step 2: If possible, disable IPv6 on interfaces where it is not needed.

4.3 Config or Code Example

Before

# No specific ICMP filtering configured

After

iptables -A INPUT -p icmp --icmp-type 139 -j DROP

4.4 Security Practices Relevant to This Vulnerability

Network segmentation and least privilege can help limit the impact of this vulnerability. Input validation is not directly applicable, but secure defaults are important.

• Practice 1: Network segmentation reduces the blast radius if an attacker maps part of your network.
• Practice 2: Least privilege limits the information available to attackers even if they gain some access.

4.5 Automation (Optional)

# Example Ansible playbook snippet to block ICMP type 139 on Debian/Ubuntu systems:
- name: Block ICMP type 139
  iptables:
    chain: INPUT
    protocol: icmp
    icmp_type: 139
    jump: DROP
    state: present

5. Verification / Validation

Confirm the fix by sending an ICMPv6 Node Information Query and verifying that no response is received.

• Post-fix check: Run `ping6 -I eth0 -n 1 ::1` again; no reply should be returned.
• Re-test: Re-run the Nmap scan (`nmap -sZ `) and confirm that ICMP information is not disclosed.
• Smoke test: Verify basic network connectivity (e.g., ping to a known host) still works as expected.
• Monitoring: Monitor firewall logs for dropped ICMP packets of type 139.

ping6 -I eth0 -n 1 ::1

6. Preventive Measures and Monitoring

Update your security baselines to include a rule blocking ICMP type 139 queries. Consider adding checks in CI/CD pipelines to ensure this rule is present on new systems.

• Baselines: Include firewall rules blocking unsolicited ICMPv6 Node Information Queries in your standard system baseline.
• Pipelines: Add a check during deployment to verify the presence of the necessary firewall rule.
• Asset and patch process: Review network configurations regularly for compliance with security standards.

7. Risks, Side Effects, and Roll Back

Blocking ICMP type 139 may interfere with some network diagnostic tools. The roll back is to remove the firewall rule.

• Roll back: Remove the `iptables` rule using `iptables -D INPUT -p icmp –icmp-type 139 -j DROP`.

8. References and Resources

• Vendor advisory or bulletin: No specific vendor advisory available for this general information disclosure issue.
• NVD or CVE entry: No specific CVE assigned for this general information disclosure issue.
• Product or platform documentation relevant to the fix: Kernel Documentation on ICMP Firewalling.