RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using …
Critical CVSS 9.0
Summary
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
- :
- :
Sources
- NVD DATABASE
Original Links
- http://www.openwall.com/lists/oss-security/2024/07/09/4 Mailing List
- https://cert-portal.siemens.com/productcert/html/ssa-723487.html
- https://cert-portal.siemens.com/productcert/html/ssa-794185.html
- https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/ Technical Description
- https://datatracker.ietf.org/doc/html/rfc2865 Technical Description
- https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf Third Party Advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014 Third Party Advisory
- https://www.blastradius.fail/ Technical Description
- http://www.openwall.com/lists/oss-security/2024/07/09/4 Mailing List
- https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/ Technical Description
- https://datatracker.ietf.org/doc/html/rfc2865 Technical Description
- https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf Third Party Advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20240822-0001/ Third Party Advisory
- https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol Third Party Advisory
- https://www.blastradius.fail/ Technical Description
- https://www.kb.cert.org/vuls/id/456537
- https://cert-portal.siemens.com/productcert/html/ssa-364175.html
- https://cert-portal.siemens.com/productcert/html/ssa-723487.html
- https://cert-portal.siemens.com/productcert/html/ssa-770770.html
- https://cert-portal.siemens.com/productcert/html/ssa-794185.html
Timeline
- nvd_ingest NVD