CVE-2024-3596

RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.

Severity Score

9.0

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track*

*SSVC

Descriptions

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.

El protocolo RADIUS según RFC 2865 es susceptible a ataques de falsificación por parte de un atacante local que puede modificar cualquier respuesta válida (acceso-aceptación, acceso-rechazo o acceso-desafío) a cualquier otra respuesta utilizando un ataque de colisión de prefijo elegido contra la firma del autenticador de respuesta MD5. .

A vulnerability in the RADIUS (Remote Authentication Dial-In User Service) protocol allows attackers to forge authentication responses when the Message-Authenticator attribute is not enforced. This issue arises from a cryptographically insecure integrity check using MD5, enabling attackers to spoof UDP-based RADIUS response packets. This can result in unauthorized access by modifying an Access-Reject response to an Access-Accept response, thereby compromising the authentication process.

*Credits: Thanks to Sharon Goldberg, Miro Haller, Nadia Heninger, Mike Milano, Dan Shumow, Marc Stevens, and Adam Suhl who researched and reported this vulnerability

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

High

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:Track*

Exploitation

None

Automatable

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2024-04-10 CVE Reserved
2024-07-09 CVE Published
2024-07-09 First Exploit
2024-08-29 CVE Updated
2024-12-31 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel

CAPEC

References (9)

URL	Tag	Source
http://www.openwall.com/lists/oss-security/2024/07/09/4
https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius
https://datatracker.ietf.org/doc/html/rfc2865
https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf
https://www.blastradius.fail
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014

URL	Date	SRC
https://github.com/alperenugurlu/CVE-2024-3596-Detector	2024-07-09

URL	Date	SRC

URL	Date	SRC
https://access.redhat.com/security/cve/CVE-2024-3596	2024-11-13
https://bugzilla.redhat.com/show_bug.cgi?id=2263240	2024-11-13

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Broadcom Search vendor "Broadcom"		Brocade Sannav Search vendor "Broadcom" for product "Brocade Sannav"				*		-		Affected
Fortinet Search vendor "Fortinet"		Fortiproxy Search vendor "Fortinet" for product "Fortiproxy"				*		-		Affected
Freeradius Search vendor "Freeradius"		Freeradius Search vendor "Freeradius" for product "Freeradius"				*		-		Affected
Ietf Search vendor "Ietf"		Rfc Search vendor "Ietf" for product "Rfc"				*		-		Affected
Oracle Search vendor "Oracle"		Linux Search vendor "Oracle" for product "Linux"				*		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"				*		-		Affected
Redhat Search vendor "Redhat"		Rhel Aus Search vendor "Redhat" for product "Rhel Aus"				*		-		Affected
Redhat Search vendor "Redhat"		Rhel E4s Search vendor "Redhat" for product "Rhel E4s"				*		-		Affected
Redhat Search vendor "Redhat"		Rhel Eus Search vendor "Redhat" for product "Rhel Eus"				*		-		Affected
Redhat Search vendor "Redhat"		Rhel Tus Search vendor "Redhat" for product "Rhel Tus"				*		-		Affected
F5 Search vendor "F5"		Big-ip Search vendor "F5" for product "Big-ip"				*		-		Affected
Alma Search vendor "Alma"		Linux Search vendor "Alma" for product "Linux"				*		-		Affected
Amazon Search vendor "Amazon"		Linux Search vendor "Amazon" for product "Linux"				*		-		Affected
Broadcom Search vendor "Broadcom"		Fabric Operating System Search vendor "Broadcom" for product "Fabric Operating System"				*		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				*		-		Affected
Fedoraproject Search vendor "Fedoraproject"		Fedora Search vendor "Fedoraproject" for product "Fedora"				*		-		Affected
Opensuse Search vendor "Opensuse"		Leap Search vendor "Opensuse" for product "Leap"				*		-		Affected
Oracle Search vendor "Oracle"		Linux Search vendor "Oracle" for product "Linux"				*		-		Affected
Redhat Search vendor "Redhat"		Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"				*		-		Affected
Redhat Search vendor "Redhat"		Rhel Aus Search vendor "Redhat" for product "Rhel Aus"				*		-		Affected
Redhat Search vendor "Redhat"		Rhel E4s Search vendor "Redhat" for product "Rhel E4s"				*		-		Affected
Redhat Search vendor "Redhat"		Rhel Els Search vendor "Redhat" for product "Rhel Els"				*		-		Affected
Redhat Search vendor "Redhat"		Rhel Eus Search vendor "Redhat" for product "Rhel Eus"				*		-		Affected
Redhat Search vendor "Redhat"		Rhel Tus Search vendor "Redhat" for product "Rhel Tus"				*		-		Affected
Rocky Search vendor "Rocky"		Linux Search vendor "Rocky" for product "Linux"				*		-		Affected
Sonicwall Search vendor "Sonicwall"		Sonicos Search vendor "Sonicwall" for product "Sonicos"				*		-		Affected
Suse Search vendor "Suse"		Sle-module-server-applications Search vendor "Suse" for product "Sle-module-server-applications"				*		-		Affected
Suse Search vendor "Suse"		Sle-sdk Search vendor "Suse" for product "Sle-sdk"				*		-		Affected
Suse Search vendor "Suse"		Sle Hpc-espos Search vendor "Suse" for product "Sle Hpc-espos"				*		-		Affected
Suse Search vendor "Suse"		Sle Hpc-ltss Search vendor "Suse" for product "Sle Hpc-ltss"				*		-		Affected
Suse Search vendor "Suse"		Sle Hpc Search vendor "Suse" for product "Sle Hpc"				*		-		Affected
Suse Search vendor "Suse"		Sles-ltss Search vendor "Suse" for product "Sles-ltss"				*		-		Affected
Suse Search vendor "Suse"		Sles Search vendor "Suse" for product "Sles"				*		-		Affected
Suse Search vendor "Suse"		Sles Sap Search vendor "Suse" for product "Sles Sap"				*		-		Affected
Suse Search vendor "Suse"		Suse-manager-proxy Search vendor "Suse" for product "Suse-manager-proxy"				*		-		Affected
Suse Search vendor "Suse"		Suse-manager-server Search vendor "Suse" for product "Suse-manager-server"				*		-		Affected