How to remediate – Nessus UDP Scanner

1. Introduction

The Nessus UDP Scanner vulnerability means it’s possible to determine which UDP ports are open on a target system. This information can help attackers identify potential services running and attempt further exploitation. Systems using UDP, such as DNS servers, DHCP servers, and some network devices, are usually affected. A successful scan could lead to reconnaissance of available services, potentially impacting confidentiality through service discovery.

2. Technical Explanation

This plugin performs a UDP port scan by sending packets to every UDP port on the target system. If a port is open, the application typically doesn’t respond. Closed ports may trigger an ICMP “Host unreachable” or “bad port” message, but this isn’t always reliable as firewalls often block ICMP traffic. The scanner identifies open ports based on the lack of response, which can be inaccurate in complex networks with intermediate devices. UDP scanning is slow because of timeout requirements and rate limiting of ICMP responses.

• Root cause: The plugin relies on the absence of an ICMP response to identify open ports.
• Exploit mechanism: An attacker uses the scanner to map open UDP ports, then attempts to exploit services running on those ports. For example, they might scan for port 53 (DNS) and attempt a DNS zone transfer if it’s allowed.
• Scope: Any system reachable via UDP is potentially affected. This includes Windows, Linux, macOS, network devices, and virtual machines.

3. Detection and Assessment

Confirming vulnerability involves checking for open UDP ports and understanding the environment’s ICMP filtering. A quick check can show running services using UDP; a thorough method is to run the Nessus scan itself.

• Quick checks: Use `netstat -an | grep udp` on Linux or `netstat -ano | findstr udp` on Windows to list listening UDP ports.
• Scanning: The Nessus plugin itself (UDP Port Scan) can be used for assessment, but results should be treated as weak signals.
• Logs and evidence: Examine firewall logs for blocked ICMP traffic related to the target system’s IP address.

netstat -an | grep udp

4. Solution / Remediation Steps

Fixing this issue involves protecting the target with an IP filter or implementing ICMP rate limitation. These steps reduce the scanner’s ability to accurately identify open ports.

4.1 Preparation

• Dependencies: Ensure you have administrative access to the firewall or network device. Roll back by reverting the firewall configuration to the previous snapshot.
• Change window: A change window may be needed if implementing ICMP rate limiting impacts other services. Approval from a network engineer is recommended.

4.2 Implementation

1. Step 1: Block all inbound UDP traffic except for necessary ports using firewall rules.
2. Step 2: If blocking isn’t possible, implement ICMP rate limiting on the firewall to slow down port scans.
3. Step 3: Review and test the new firewall rules or ICMP rate limit settings.

4.3 Config or Code Example

Before

# Allow all UDP traffic (example iptables rule)
iptables -A INPUT -p udp --dport 1-65535 -j ACCEPT

After

# Only allow specific UDP ports (example iptables rule)
iptables -A INPUT -p udp --dport 53 -j ACCEPT  # DNS
iptables -A INPUT -p udp --dport 67 -j ACCEPT  # DHCP Server
iptables -A INPUT -p udp -j DROP # Drop all other UDP traffic.

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help address this vulnerability type. Least privilege reduces the impact of successful scans, and network segmentation limits the scope of potential attacks.

• Practice 1: Least privilege – only allow necessary UDP ports through firewalls.
• Practice 2: Network segmentation – isolate critical systems to limit the spread of an attack.

4.5 Automation (Optional)

# Example Ansible playbook to block UDP ports
---
- hosts: firewalls
  tasks:
    - name: Block all inbound UDP traffic except DNS and DHCP
      iptables:
        chain: INPUT
        protocol: udp
        destination_port: '1-65535'
        jump: DROP
        state: present
    - name: Allow DNS port 53
      iptables:
        chain: INPUT
        protocol: udp
        destination_port: 53
        jump: ACCEPT
        state: present
    - name: Allow DHCP port 67
      iptables:
        chain: INPUT
        protocol: udp
        destination_port: 67
        jump: ACCEPT
        state: present

5. Verification / Validation

Confirm the fix by re-running the Nessus scan and verifying that fewer UDP ports are reported as open. Also, test key services to ensure they still function correctly.

• Post-fix check: Run `netstat -an | grep udp` again; only expected listening ports should be displayed.
• Re-test: Re-run the Nessus UDP Port Scan plugin and confirm that fewer ports are detected as open.
• Smoke test: Verify DNS resolution still works (e.g., using `nslookup google.com`) and DHCP clients can obtain IP addresses.
• Monitoring: Monitor firewall logs for unexpected UDP traffic or blocked ICMP messages.

netstat -an | grep udp

6. Preventive Measures and Monitoring

Update security baselines to include restricted UDP port access, and add checks in CI/CD pipelines to prevent misconfigured firewalls. Regular patch reviews are also important.

• Baselines: Update your firewall baseline or CIS control configuration to restrict inbound UDP traffic.
• Pipelines: Add a check to your infrastructure as code pipeline to ensure that firewall rules meet security standards.
• Asset and patch process: Review firewall configurations regularly (e.g., quarterly) for compliance with security policies.

7. Risks, Side Effects, and Roll Back

Blocking UDP traffic could disrupt legitimate services; ICMP rate limiting may impact network performance. Roll back by reverting the firewall configuration to its previous state.

• Risk or side effect 1: Blocking necessary UDP ports can cause service outages. Mitigation: Carefully identify and allow only essential ports.

8. References and Resources

• Vendor advisory or bulletin: No specific vendor advisory available for this general scan technique.
• NVD or CVE entry: Not applicable, as this is a scanning technique rather than a specific exploit.
• Product or platform documentation relevant to the fix: Refer to your firewall vendor’s documentation on configuring IP filters and ICMP rate limiting.