Mooncake Transfer Engine DoS via Handshake Block

Executive Summary

This vulnerability is a denial of service issue in the Mooncake transfer engine through version 0.3.13.post1. Unauthenticated remote attackers can exploit it by sending a Metadata request to the handshake RPC port and never reading replies. This stalls the SocketHandShakePlugin's single listener thread in writeFully(), blocking all subsequent handshakes, metadata fetches, notify and probe requests.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability involves monitoring for stalled handshake processes or blocked RPC ports. Check for processes named SocketHandShakePlugin or related to the Mooncake transfer engine. Use commands like 'netstat -tuln | grep <handshake_port>' to identify open RPC ports. Monitor system logs for repeated failed handshake attempts or timeouts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can disrupt the availability of the Mooncake transfer engine by preventing legitimate users from establishing handshakes or fetching metadata. It may cause service outages or delays in data transfers, impacting operations relying on this engine.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it is a denial of service issue affecting availability rather than data confidentiality or integrity. However, prolonged downtime could indirectly affect compliance by disrupting services that handle personal or health data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Mooncake transfer engine to version 0.3.13.post1 or later. Restrict network access to the handshake RPC port using firewalls. Implement rate limiting on the RPC port to prevent abuse. Monitor for unusual activity and terminate any suspicious connections.

Useful 0 Not Useful 0