[ZOOKEEPER-2693] DOS attack on wchp/wchc four letter words (4lw)

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 3.4.0, 3.5.1, 3.5.2
• Fix Version/s: 3.4.10, 3.5.3, 3.6.0
• Component/s: security, server
• Labels: pull-request-available
• Assignee: Michael Han
• Reporter: Patrick D. Hunt
• Created: 14/Feb/17 03:33
• Updated: 06/Mar/21 21:36
• Resolved: 07/Mar/17 06:26

Description

The wchp/wchc four letter words can be exploited in a DOS attack on the ZK client port - typically 2181. The following POC attack was recently published on the web:

https://vulners.com/exploitdb/EDB-ID:41277

The most straightforward way to block this attack is to not allow access to the client port to non-trusted clients - i.e. firewall the ZooKeeper service and only allow access to trusted applications using it for coordination.

Issue Links

• is related to: ZOOKEEPER-2726 Patch for ZOOKEEPER-2693 introduces potential race condition
• relates to: ZOOKEEPER-2713 Create CVE text for ZOOKEEPER-2693 "DOS attack on wchp/wchc four letter words (4lw)"
• links to: GitHub Pull Request #
• links to: GitHub Pull Request #179
• links to: GitHub Pull Request #183
• links to: GitHub Pull Request #1608