RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using …
严重 CVSS 9.0
摘要
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.
中文摘要建设中，暂以英文摘要呈现（DR-003 v2）。
深度研判
该漏洞尚未生成深度研判报告（DR-003 v2 AI pipeline 建设中）。
受影响产品
- :
- :
- :
数据来源
- NVD DATABASE
原始链接
- http://www.openwall.com/lists/oss-security/2024/07/09/4 Mailing List
- https://cert-portal.siemens.com/productcert/html/ssa-723487.html
- https://cert-portal.siemens.com/productcert/html/ssa-794185.html
- https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/ Technical Description
- https://datatracker.ietf.org/doc/html/rfc2865 Technical Description
- https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf Third Party Advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014 Third Party Advisory
- https://www.blastradius.fail/ Technical Description
- http://www.openwall.com/lists/oss-security/2024/07/09/4 Mailing List
- https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/ Technical Description
- https://datatracker.ietf.org/doc/html/rfc2865 Technical Description
- https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf Third Party Advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240822-0001/ Third Party Advisory
- https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol Third Party Advisory
- https://www.blastradius.fail/ Technical Description
- https://www.kb.cert.org/vuls/id/456537
- https://cert-portal.siemens.com/productcert/html/ssa-364175.html
- https://cert-portal.siemens.com/productcert/html/ssa-723487.html
- https://cert-portal.siemens.com/productcert/html/ssa-770770.html
- https://cert-portal.siemens.com/productcert/html/ssa-794185.html
时间线
- nvd_ingest NVD