Network operators are warned about a RADIUS protocol flaw
Take action: This is mostly a long term awareness advisory. Unless you are running FreeRadius, you can only communicate to your vendors for patch availability and be aware of this risk. Naturally, frequent patching of the network device firmware and RADIUS servers is helpful, but it's not a clear-cut fix.
Learn More
Researchers have published a paper warning about a security vulnerability in the RADIUS protocol.
The flaw is dubbed BlastRADIUS, and is tracked by CVE-2024-3596 (CVSS score varies, from 7.5 to 9.0). The issue originates from a design flaw in the RADIUS protocol, where some Access-Request packets are not authenticated and lack integrity checks. This flaw allows attackers to authenticate any user to a local network, which can lead to unauthorized network access and further exploitation.
The exploitation of this vulnerability requires a Man-in-the-Middle (MitM) attack, where the attacker needs to intercept and modify RADIUS packets between the client and server. While challenging to execute, due to the substantial CPU resources required (estimated at $1000 per packet), the complexity of implementing MitM attacks and the lack of a public exploit, it remains a notable risk, particularly for high-value targets such as financial data theft.
Affected components include:
- PAP
- CHAP
- MS-CHAPv2
- Other non-EAP authentication methods
Systems that are not vulnerable include:
- 802.1x
- IPSec
- TLS
- Eduroam
- OpenRoaming
Full research paper is available here
At the moment there is no clear cut solution to the problem. Network operators and administrators are advised to update all RADIUS servers and clients. The updated RADIUS implementations incorporate integrity and authentication checks for Access-Request packets, addressing the underlying design flaw.
As of 10th of July 2024, only FreeRadius, an open source implementation of a RADIUS server has officially patched the issue in their implementation. Network operators can't do much immediately except communicating to their vendors to get info on patch availability.
Update - As of 11th of July Palo Alto Networks released patches for blastRadius
