Feeds

New RADIUS vulns exposed

No rest for the wicked

  • alert
  • submit to reddit

Intelligent flash storage arrays

Numerous holes in the ubiquitous RADIUS (remote authentication dial-in user service) protocol can be exploited with results including denial of service and running arbitrary code on the target device, a Russian security researcher has demonstrated. The risk of the DoS attack is considerably greater, and can be achieved two ways.

First up, according to a bulletin by '3APA3A', during authentication in several implementations a digest is created consisting of an initial packet, a message authenticator and a shared secret concatenated and calculated as an MD5 hash. Unfortunately, the process doesn't check for adequate space in the target buffer. Thus a shared secret can be used to overload the buffer, and cause a denial of service.

If the shared secret were accurately guessed, an attacker could get privileges on the target RADIUS client or server. While this is far from a trivial exercise, we note that according to researcher Joshua Hill, "most client and server implementations only allow shared secrets to be input as ASCII strings. There are only 94 different ASCII characters that can be entered from a standard US style keyboard (out of the 256 possible). Many implementations also restrict the total length of the shared secret to 16 characters or less. Both of these restrictions artificially reduce the size of the keyspace that an attacker must search in order to guess the shared secret."

Next up, still following the 3APA3A bulletin, we have improper validation of a vendor-specific attribute. Vendor-specific and user-specific attributes can be passed to the client. If the vendor-specific header contains less than two bytes, it will be calculated as a negative number and a denial of service will result. It is not necessary to know the shared secret to abuse this flaw.

RADIUS is used widely by ISPs and NSPs for remote user authentication, so these issues are likely to affect a large number of admins and a vast heap of equipment and software. It's ubiquitous chiefly because it's embedded in numerous devices such as routers and switches.

3APA3A has a simple tool for testing RADIUS vulnerabilities available here.

CERT has a bulletin listing all equipment and software presently known to be vulnerable, along with links to the vendors, posted here. ®

Security for virtualized datacentres

More from The Register

next story
Just don't blame Bono! Apple iTunes music sales PLUMMET
Cupertino revenue hit by cheapo downloads, says report
The DRUGSTORES DON'T WORK, CVS makes IT WORSE ... for Apple Pay
Goog Wallet apparently also spurned in NFC lockdown
IBM, backing away from hardware? NEVER!
Don't be so sure, so-surers
Hey - who wants 4.8 TERABYTES almost AS FAST AS MEMORY?
China's Memblaze says they've got it in PCIe. Yow
Microsoft brings the CLOUD that GOES ON FOREVER
Sky's the limit with unrestricted space in the cloud
This time it's SO REAL: Overcoming the open-source orgasm myth with TODO
If the web giants need it to work, hey, maybe it'll work
'ANYTHING BUT STABLE' Netflix suffers BIG Europe-wide outage
Friday night LIVE? Nope. The only thing streaming are tears down my face
Google roolz! Nest buys Revolv, KILLS new sales of home hub
Take my temperature, I'm feeling a little bit dizzy
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.