CVE-2024-3596: RADIUS Protocol MD5 collision forgery attack (Blast-RADIUS)

CVE-2024-3596 · Severity: critical · CVSS 9 · Published 2024-07-09

A fundamental flaw has been identified in the RADIUS protocol, a widely used standard for authenticating users on corporate networks, VPNs, and networking equipment. An attacker positioned on the network between a device and the authentication server can intercept and modify traffic to grant themselves unauthorized access. This could allow an attacker to bypass security checks, including multi-factor authentication, and gain full access to sensitive network resources without needing valid credentials.

Technologies: Broadcom Brocade Sannav, Freeradius, Siemens RUGGEDCOM CROSSBOW, SonicWall SonicOS. Vendors: Broadcom, Freeradius, Siemens, SonicWall.

Quick answers

Is CVE-2024-3596 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-3596 being exploited in the wild.
How severe is CVE-2024-3596?
Critical severity, with a CVSS score of 9, published 9 July 2024.
Which products and versions are affected?
Ietf RADIUS Protocol All versions using MD5 Response Authenticator without Message-Authenticator attribute; Siemens RUGGEDCOM CROSSBOW < V5.6; Siemens RUGGEDCOM ROS < V4.3.11.
Is there a fix for CVE-2024-3596?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2024-3596 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-3596?
Check whether you run Broadcom Brocade Sannav, Broadcom Fabric Operating System, Freeradius or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The RADIUS protocol (RFC 2865) is susceptible to a chosen-prefix collision attack against the MD5-based Response Authenticator signature. An on-path attacker (Man-in-the-Middle) can intercept an Access-Request and modify the server's response (e.g., changing an Access-Reject to an Access-Accept) by manipulating the MD5 hash. This is possible because the protocol lacks mandatory integrity checks for the entire packet in many configurations. The attack, known as 'Blast-RADIUS', allows for the injection of arbitrary attributes and can bypass Multi-Factor Authentication (MFA) if it relies on Access-Challenge packets. Mitigation requires enforcing the 'Message-Authenticator' attribute or migrating to RADIUS over TLS (RadSec) or DTLS.

Affected products

  • FreeRADIUS FreeRADIUS < 3.0.27
  • IETF RADIUS Protocol (RFC 2865) All versions using MD5 Response Authenticator without Message-Authenticator attribute
  • Siemens RUGGEDCOM ROS < V4.3.11
  • Siemens RUGGEDCOM CROSSBOW < V5.6
  • Broadcom Fabric Operating System
  • SonicWall SonicOS

Timeline

  • 2024-07-09: disclosed: Public disclosure of Blast-RADIUS attack
  • 2024-07-09: advisory: Initial NVD and vendor advisories published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.