JVN#81094176: Android OS may behave as an open resolver

2015-03-27T00:00:00
ID JVN:81094176
Type jvn
Reporter Japan Vulnerability Notes
Modified 2015-06-26T00:00:00

Description

## Description

A device that runs as a DNS cache server, which responds to any recursive DNS queries that are received is referred to as an open resolver.
Android OS contains an issue where it may behave as an open resolver when the tethering function is enabled.

## Impact

The Android device may be used in a DNS amplification attack and unknowingly become a part of a DDoS attack.

A device is not affected by this issue depending on the network it is connected to. For details, refer to the information provided under "Vendor Status".

## Solution

Apply an Update
Apply the update according to the information provided by the provider or developer.

Apply a Workaround
The following workaround may mitigate the affects of this vulnerability.

  • Do not connect to an untrusted network or Wi-Fi access point with the tethering function on

## Products Affected

  • Android OS versions prior to 4.3