RADIUS: RADIUS Response Forgery (CVE-2024-3596) #shorts #breaking

CVE

This CVE relates to a new vulnerability known as RADIUS Response Forgery. It affects the RADIUS Protocol under RFC 2865, allowing a local attacker to modify any valid response, such as Access-Accept, Access-Reject, or Access-Challenge, to any other response. This is achieved using a chosen-prefix collision attack against the MD5 Response Authenticator signature. The scope of those potentially affected includes users of freeradius-server. Currently, it is unknown who has been attacked using this method.

This chain involves the following actors

This following systems are involved

Attack entry point

Remediation actions

Exploitation actions

• https://datatracker.ietf.org/doc/html/rfc2865
• https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/
• https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf
• https://www.blastradius.fail/
• http://www.openwall.com/lists/oss-security/2024/07/09/4
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014