Chargen UDP Service Remote DoS

Overview

The Character Generator Protocol (Chargen) is an Internet service defined in RFC 864 that can be exploited for remote denial-of-service (DoS) attacks. When exploited, it sends a continuous stream of characters to a requesting host or an unwitting third party, leading to network saturation.

• Severity: High

Impact

The impact of a Chargen UDP Service Remote DoS attack is primarily network saturation, which can degrade performance or cause network outages. Systems that rely on network availability for operations may experience disruptions, potentially leading to significant downtime and associated costs.

Cause

The vulnerability is caused by the presence of an enabled Chargen service that responds to incoming UDP requests. This service, when exploited, sends random characters to the source port of the request, which can be spoofed to target a third party.

Solution

The best solution is to disable the Chargen service if it's not required, as it's often unnecessary in modern network environments.

Windows:

1. Open the Services management console (services.msc).
2. Locate any service related to Chargen or similar diagnostic services and set their startup type to "Disabled".
3. Restart the machine if necessary to ensure changes take effect.

Unix/Linux:

1. Check if inetd or xinetd is running the Chargen service. You can usually find it in /etc/inetd.conf or /etc/xinetd.d/chargen.
2. Comment out the Chargen service line by adding a # at the beginning of the line.
3. Restart the inetd or xinetd service. For example, sudo service xinetd restart.

Network Devices (Router/Switches):

1. Access the configuration mode (usually via CLI).
2. Disable the Chargen service. This command varies by vendor, e.g., no service tcp-small-servers and no service udp-small-servers on Cisco devices.
3. Save the configuration and restart the device if necessary.

Examples

The following shows how an ACL on a Cisco router might be configured to block Chargen traffic:

access-list 100 deny udp any any eq 19
access-list 100 permit ip any any
interface [your_interface]
ip access-group 100 in

References

• RFC 864
• Cisco Guide to Harden Cisco IOS Devices

Additional Resources

N/A