How to remediate – LANDesk Ping Discovery Service Detection

1. Introduction

The LANDesk Ping Discovery Service Detection vulnerability indicates that an asset management agent is listening on a remote host. This service is part of the LANDesk Management Suite and used for communication with administrative consoles. Its presence can indicate unnecessary exposure of network services, potentially allowing unauthorized access or information gathering. Confidentiality, integrity, and availability could be impacted if exploited.

2. Technical Explanation

The vulnerability stems from the Ping Discovery Service running on managed clients within a LANDesk Management Suite deployment. Attackers can remotely detect these services and potentially exploit them for further reconnaissance or lateral movement within the network. There is no known CVE associated with this specific detection, but it represents a potential attack vector due to exposed network ports. An attacker could identify systems running the service and attempt to compromise them through other vulnerabilities or brute-force attacks. Affected platforms are those running LANDesk Management Suite clients.

• Root cause: The Ping Discovery Service is enabled by default on managed clients for communication with the administrative console.
• Exploit mechanism: An attacker scans a network and identifies systems listening on the port used by the Ping Discovery Service. They then attempt to exploit other vulnerabilities or gain access through brute-force attacks.
• Scope: Systems running LANDesk Management Suite clients are affected.

3. Detection and Assessment

To confirm whether a system is vulnerable, you can check for the listening service directly on the host. A thorough method involves network scanning to identify open ports associated with the Ping Discovery Service.

• Quick checks: Use netstat -an | find "8021" (default port) to check if the service is listening.
• Scanning: Nessus vulnerability ID ae87ac86 can identify this service. This should be used as an example only, and other scanners may provide similar functionality.
• Logs and evidence: Check system logs for events related to LANDesk Management Suite communication on port 8021.

netstat -an | find "8021"

4. Solution / Remediation Steps

To fix the issue, filter incoming traffic to the port used by the Ping Discovery Service. This reduces the attack surface and prevents unauthorized access.

4.1 Preparation

• Ensure a rollback plan is in place to revert firewall changes if needed. A change window may be required depending on network infrastructure.

4.2 Implementation

1. Step 1: Block incoming traffic on TCP port 8021 (default) at the network firewall.
2. Step 2: Review existing firewall rules to ensure no legitimate traffic is blocked unintentionally.

4.3 Config or Code Example

Before

# No specific rule blocking port 8021

After

# Block incoming traffic on TCP port 8021
iptables -A INPUT -p tcp --dport 8021 -j DROP #Example using iptables. Adjust for your firewall.

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this issue. Least privilege reduces the impact if exploited, while network segmentation limits lateral movement.

• Practice 1: Least privilege – only allow necessary services and ports to be open on systems.
• Practice 2: Network segmentation – isolate critical systems from less trusted networks.

4.5 Automation (Optional)

# Example Ansible playbook to block port 8021 on firewalld systems
- name: Block LANDesk Ping Discovery Service Port
  hosts: all
  become: true
  tasks:
    - name: Block port 8021 using firewalld
      firewalld:
        port: 8021/tcp
        permanent: true
        state: disabled
        immediate: yes

5. Verification / Validation

Confirm the fix by checking that incoming traffic is blocked on port 8021. Re-run the earlier detection method to verify the service is no longer accessible. A simple smoke test involves verifying other LANDesk Management Suite functionality still works as expected.

• Post-fix check: Use netstat -an | find "8021" and confirm no listening services are found on that port.
• Re-test: Run the Nessus scan (ae87ac86) again, and verify it does not report the vulnerability.
• Smoke test: Verify LANDesk agent communication with the console is still functioning correctly.
• Monitoring: Monitor firewall logs for blocked connections on port 8021 as an example of a regression indicator.

netstat -an | find "8021"

6. Preventive Measures and Monitoring

Update security baselines to include blocking unnecessary ports like the one used by the Ping Discovery Service. Implement checks in CI/CD pipelines to prevent similar misconfigurations. Maintain a sensible patch or configuration review cycle to address vulnerabilities promptly.

• Baselines: Update your network security baseline to block port 8021 unless specifically required.
• Asset and patch process: Review system configurations regularly for unnecessary services or exposed ports.

7. Risks, Side Effects, and Roll Back

• Risk or side effect 1: Blocking the port could interrupt communication with LANDesk Management Suite consoles if the service is still in use.
• Roll back: Remove the firewall rule blocking TCP port 8021 to restore connectivity.

8. References and Resources

• Vendor advisory or bulletin: http://www.nessus.org/u?ae87ac86