Portmapper Vulnerability - Virgin Media Security Alert telling me to block port 111 on my router
I keep getting emails (sporadically) from Virgin Media (my ISP) saying 'Your home devices could be at risk'. I have had two such in the last 7 days.
Extracting their key message:
START
Since we last wrote to you we have again been alerted that a device connected to your home network has been identified as having a potential Portmapper vulnerability.
A Portmapper vulnerability is a security issue whereby a 3rd party can use this protocol to gain unauthorised access to your network/devices for malicious purposes. If a 3rd party has access to your network/devices they will be able to perform a Distributed Denial of Service (DDoS) attack.
It is therefore important that you follow the advice in this letter.
What has happened?
We suspect the device may have been misconfigured by you, someone in your household or without your knowledge. If the settings are left unchanged they can be exploited to unwittingly participate in malicious activities, for example a Distributed Denial of Service (DDoS) attack.
Details:
IP: 81.109.90.249
Date: 02 April 2024
How can this issue be resolved?
To fix this problem please visit virginmedia.com/portmapper for guidance on how to secure your network.
END
I use the supplied Virgin Media Hub as a modem and the Deco X20 provides my routing. So effectively the Virgin Media Hub is 'dumb' and the X20 controls my Firewall.
Looking at the VM site about Open Portmapper Vulnerability it says:
START
Portmapper (also known as RPC Bind or RPC Portmap) is a service used by computer systems to assist with networking tasks. Unfortunately, Portmapper currently has a bug that can allow remote third-party attackers to gain unauthorised access and perform Distributed Denial of Service (DDoS) attacks against target machines. A remote attacker can take advantage of this bug by sending a specially crafted request to an affected Portmapper server.
Block external Portmapper traffic
The easiest way to fix an open Portmapper vulnerability is to set your firewall to block UDP port 111.
END
I cannot find any way in the Deco app to look to carry out the blocking as advised by Virgin.
So, three questions:
- Is there a way to block the specific port as advised by Virgin Media?
- If not does it matter?
- Am I protected by my Deco Firewall as a matter of course? That is do I worry or not.
Thanks (in anticipation) for any advice/guidance.
Hi.
Thanks for your observations and advice.
The Virgin SuperHub is in Modem mode. (That is it is bridging I think you said.)
I set it some time previously to modem mode as before I had the Deco X20 I had a TP-Link Archer AC1750 Wireless Dual Band Gigabit RouterArcher C7/Archer A7. And that was the instructions for setting it up. However the Archer left me with dead spots when I moved to a bigger house, hence moving to the X20 mesh system. [Of course with the Archer you could configure (and see) ports through its very detailed configuration page which the Deco app can't do.)
I followed that same approach when I set up the X20s.
Then thinking about it, I have another point to make. I have a Synology NAS (DS220+).
This is accessible from outside my LAN by using the Synology Quick Connect app. But when you set up the Synology for external access I remember that the software carries out an automatic configuration of the router opening up various ports as necessary.
Remembering this has prompted me to look at the Router Configuration page [part extracted] and it shows thus:
So it is the Synology that has opened port 111. I guess I said yes to everything(!!)
As I don't use Mac/Linux file server (unless it interacts with QuickConnect) I am going to disable that function which I assume will then close down those particular ports to access through the Firewall.
I assume once that is done it will stop any of the Portmapper 'attacks' occurring?
One additional question. I am assuming that at least in the immediate time that I leave my LAN set up as it is. That is the SuperHub in modem mode and the X20s doing the routing. If all else fails I go back to your original recommendation i.e. configure Deco mesh to run in Access Point mode and start a conversation with Virgin Media.
Many thanks for your advice and time. If I need to come back to the TP Home Network Community I will.
Chris
Hi.
Thanks for your observations and advice.
The Virgin SuperHub is in Modem mode. (That is it is bridging I think you said.)
I set it some time previously to modem mode as before I had the Deco X20 I had a TP-Link Archer AC1750 Wireless Dual Band Gigabit RouterArcher C7/Archer A7. And that was the instructions for setting it up. However the Archer left me with dead spots when I moved to a bigger house, hence moving to the X20 mesh system. [Of course with the Archer you could configure (and see) ports through its very detailed configuration page which the Deco app can't do.)
I followed that same approach when I set up the X20s.
Then thinking about it, I have another point to make. I have a Synology NAS (DS220+).
This is accessible from outside my LAN by using the Synology Quick Connect app. But when you set up the Synology for external access I remember that the software carries out an automatic configuration of the router opening up various ports as necessary.
Remembering this has prompted me to look at the Router Configuration page [part extracted] and it shows thus:
So it is the Synology that has opened port 111. I guess I said yes to everything(!!)
As I don't use Mac/Linux file server (unless it interacts with QuickConnect) I am going to disable that function which I assume will then close down those particular ports to access through the Firewall.
I assume once that is done it will stop any of the Portmapper 'attacks' occurring?
One additional question. I am assuming that at least in the immediate time that I leave my LAN set up as it is. That is the SuperHub in modem mode and the X20s doing the routing. If all else fails I go back to your original recommendation i.e. configure Deco mesh to run in Access Point mode and start a conversation with Virgin Media.
Many thanks for your advice and time. If I need to come back to the TP Home Network Community I will.
Chris