NetX Secure DTLS Server Cookie Verification Bypass

Executive Summary

The NetX Secure DTLS server sends a HelloVerifyRequest with a randomly generated cookie but fails to validate the cookie returned by the client. Instead, it overwrites the issued cookie with the client's cookie and only checks the cookie's length. An attacker can forge a ClientHello with a single-byte cookie, bypassing verification and completing a DTLS handshake from a spoofed source address.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if your NetX Duo DTLS server is running a vulnerable version (up to 6.5.2.202603). Inspect server logs for unusual ClientHello exchanges or session exhaustion patterns. Use network monitoring tools to detect traffic amplification from spoofed addresses.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability enables two main attacks: session pool exhaustion, where forged ClientHellos consume limited session slots on the server, denying service to legitimate clients, and traffic amplification, where a small forged packet from a victim's address triggers a large response from the server, potentially overwhelming third-party systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt service availability, potentially violating requirements for data access, processing, or security controls. The session exhaustion and traffic amplification risks may lead to unauthorized resource consumption or service disruptions, which could be considered failures in maintaining system integrity and availability under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade NetX Duo to version 6.5.2.202603a or later to fix the cookie validation issue. If upgrading is not immediately possible, implement ingress filtering to block spoofed source addresses and set session limits to reduce exposure to session pool exhaustion attacks.

Useful 0 Not Useful 0