CVE-2019-3978 : Security Advisory and Response

A vulnerability in MikroTik RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and earlier allows remote unauthenticated attackers to exploit DNS queries, potentially leading to cache poisoning.

Understanding CVE-2019-3978

This CVE involves a security issue in MikroTik RouterOS that enables attackers to manipulate DNS queries through a specific port, posing a risk of cache poisoning.

What is CVE-2019-3978?

CVE-2019-3978 is a vulnerability in RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and below, which permits remote unauthenticated attackers to trigger DNS queries via port 8291. The attacker can direct these queries to a chosen server, and the router caches the DNS responses, potentially leading to cache poisoning.

The Impact of CVE-2019-3978

The exploitation of this vulnerability can result in cache poisoning, allowing attackers to manipulate DNS responses and potentially redirect traffic to malicious destinations.

Technical Details of CVE-2019-3978

This section provides more in-depth technical insights into the vulnerability.

Vulnerability Description

The vulnerability in MikroTik RouterOS versions 6.45.6 Stable, 6.44.5 Long-term, and earlier allows remote unauthenticated attackers to initiate DNS queries through port 8291, leading to potential cache poisoning.

Affected Systems and Versions

Product: MikroTik RouterOS
Versions Affected: RouterOS 6.45.6 Stable and below, RouterOS 6.44.5 Long-term and below

Exploitation Mechanism

Attackers exploit the vulnerability by sending DNS queries from the router to a server of their choice through port 8291, enabling them to manipulate DNS responses and potentially poison the cache.

Mitigation and Prevention

Protecting systems from CVE-2019-3978 requires immediate actions and long-term security practices.

Immediate Steps to Take

Update RouterOS to the latest version to patch the vulnerability.
Implement firewall rules to restrict access to port 8291.
Monitor DNS traffic for any suspicious activities.

Long-Term Security Practices

Regularly update and patch all network devices and software.
Conduct security audits and penetration testing to identify vulnerabilities.
Educate network administrators and users on best security practices.

Patching and Updates

Apply the latest security patches provided by MikroTik for RouterOS.
Stay informed about security advisories and updates from MikroTik to address potential vulnerabilities.