RADIUS Protocol Forgery Vulnerability in FreeRADIUS Package
Summary
CVE-2024-3596: RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix colli... Affects freeradius across 2 version ranges.
< 3.0.27-r0
< f317c5b2668a4de7065df46b31267cd6ff32ddf1
Fixed in 3.0.27-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeRADIUS is an open-source RADIUS server that provides authentication, authorization, and accounting services for network access. It is widely used in various environments, including ISPs, enterprises, and educational institutions. The server supports a variety of authentication protocols and is known for its flexibility and scalability. However, it is vulnerable to a forgery attack that allows local attackers to manipulate valid responses, posing a significant security risk.
Vulnerability Detail
The vulnerability, identified as CVE-2024-3596, arises from the RADIUS Protocol's susceptibility to forgery attacks. A local attacker can exploit this vulnerability by modifying any valid response (Access-Accept, Access-Reject, or Access-Challenge) to another response using a chosen-prefix collision attack against the MD5 Response Authenticator signature. This could lead to unauthorized access or denial of service, as attackers can impersonate legitimate responses.
How To Fix
Minimum fixed version
3.0.27-r0
This is the first release that contains the fix.
sudo apk add --upgrade freeradiusTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the RADIUS server to trusted local users only. This can be achieved by configuring firewall rules to limit access to the server's ports (usually UDP ports 1812 and 1813) to specific IP addresses or networks.
Conclusion
The CVE-2024-3596 vulnerability in the FreeRADIUS package poses a serious threat due to its ability to allow local attackers to forge responses. Users are strongly advised to upgrade to the latest version to protect their systems. In the meantime, implementing access restrictions can serve as a temporary measure to mitigate risks.
See every vulnerability recorded for freeradius →
FAQ
CVE-2024-3596 is a vulnerability in the RADIUS Protocol that allows local attackers to forge responses, potentially leading to unauthorized access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The vulnerability can lead to unauthorized access to network resources, denial of service, and potential data breaches.
Yes, a patch is available in FreeRADIUS version 3.2.5+dfsg-1 and later. Users should upgrade to this version to mitigate the risk.
If an immediate upgrade is not possible, restrict access to the RADIUS server by configuring firewall rules to limit access to trusted users.
References
Related vulnerabilities
Recent vulnerabilities recorded for freeradius.
