Feeds

New RADIUS vulns exposed

No rest for the wicked

  • alert
  • submit to reddit

The essential guide to IT transformation

Numerous holes in the ubiquitous RADIUS (remote authentication dial-in user service) protocol can be exploited with results including denial of service and running arbitrary code on the target device, a Russian security researcher has demonstrated. The risk of the DoS attack is considerably greater, and can be achieved two ways.

First up, according to a bulletin by '3APA3A', during authentication in several implementations a digest is created consisting of an initial packet, a message authenticator and a shared secret concatenated and calculated as an MD5 hash. Unfortunately, the process doesn't check for adequate space in the target buffer. Thus a shared secret can be used to overload the buffer, and cause a denial of service.

If the shared secret were accurately guessed, an attacker could get privileges on the target RADIUS client or server. While this is far from a trivial exercise, we note that according to researcher Joshua Hill, "most client and server implementations only allow shared secrets to be input as ASCII strings. There are only 94 different ASCII characters that can be entered from a standard US style keyboard (out of the 256 possible). Many implementations also restrict the total length of the shared secret to 16 characters or less. Both of these restrictions artificially reduce the size of the keyspace that an attacker must search in order to guess the shared secret."

Next up, still following the 3APA3A bulletin, we have improper validation of a vendor-specific attribute. Vendor-specific and user-specific attributes can be passed to the client. If the vendor-specific header contains less than two bytes, it will be calculated as a negative number and a denial of service will result. It is not necessary to know the shared secret to abuse this flaw.

RADIUS is used widely by ISPs and NSPs for remote user authentication, so these issues are likely to affect a large number of admins and a vast heap of equipment and software. It's ubiquitous chiefly because it's embedded in numerous devices such as routers and switches.

3APA3A has a simple tool for testing RADIUS vulnerabilities available here.

CERT has a bulletin listing all equipment and software presently known to be vulnerable, along with links to the vendors, posted here. ®

Boost IT visibility and business value

More from The Register

next story
Pay to play: The hidden cost of software defined everything
Enter credit card details if you want that system you bought to actually be useful
HP busts out new ProLiant Gen9 servers
Think those are cool? Wait till you get a load of our racks
Shoot-em-up: Sony Online Entertainment hit by 'large scale DDoS attack'
Games disrupted as firm struggles to control network
Silicon Valley jolted by magnitude 6.1 quake – its biggest in 25 years
Did the earth move for you at VMworld – oh, OK. It just did. A lot
VMware's high-wire balancing act: EVO might drag us ALL down
Get it right, EMC, or there'll be STORAGE CIVIL WAR. Mark my words
Forrester says it's time to give up on physical storage arrays
The physical/virtual storage tipping point may just have arrived
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.