RADIUS Protocol Spoofing Vulnerability (Blast-RADIUS): July 2024
On July 7, 2024, security researchers disclosed the following vulnerability in the RADIUS protocol: CVE-2024-3596: RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by an on-path attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature. This vulnerability may impact any RADIUS client and server. For a description of this vulnerability, see VU#456537: RADIUS protocol susceptible to forgery attacks ["https://www.kb.cert.org/vuls/id/456537"].
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-3596US | critical9.0OT hoch | Exploit | ||
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any ot… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Security Vulnerability Policyexternal
- CSCwk67747external
- CSCwk67859external
- CSCwk67902external
- CSCwk69454external
- CSCwk70236external
- CSCwk70831external
- CSCwk70832external
Behebungen (1)
- BehobenCisco Adaptive Security Appliance (ASA) Software
Cisco has released software updates that address this vulnerability.
https://software.cisco.com
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan