RADIUS protocol susceptible to forgery attacks

https://www.blastradius.fail/

by byproxy • 2 years ago

63 7 2 years ago

Mitigation:

Our recommended short-term mitigation for implementers and vendors is to mandate that clients and servers always send and require Message-Authenticator attributes for all requests and responses. For Access-Accept or Access-Reject responses, the Message-Authenticator should be included as the first attribute. Patches implementing this mitigation have been implemented by all RADIUS implementations that we are aware of. This guidance is being put into an upcoming RADIUS RFC.

Paper:

"Radius/UDP Considered Harmful" Sharon Goldberg, Miro Haller, Nadia Heninger, Mike Milano, Dan Shumow, Marc Stevens, and Adam Suhl
https://www.blastradius.fail/pdf/radius.pdf

commandersaki2• 2 years ago

That's quite an excellent author list.

i_v• 2 years ago

I’m not familiar with these authors. Could you elaborate more for the folks who aren’t as deep in this space?

banish-m4• 2 years ago

RADIUS, LDAP, DIAMETER, sflow, TACAS+, SNMP (all versions), UPS, lights-out management, and similar should never-ever be deployed to public-facing networks. These should remain segregated on internal VLANs used for infrastructure only.

For wireless 802.1x, use clients certs; managed campus APs may still need a tunnel to a RADIUS box, but that's okay.

jgrahamc• 2 years ago

Write up on the Cloudflare blog: https://blog.cloudflare.com/radius-udp-vulnerable-md5-attack

RADIUS protocol susceptible to forgery attacks

Related Stories