CVE-2024-3596
📋 TL;DR
CVE-2024-3596 allows a local attacker to forge RADIUS protocol responses by exploiting MD5 collisions, enabling them to modify authentication outcomes. This affects any system using RADIUS under RFC 2865 with MD5 Response Authenticator. Network administrators and organizations using RADIUS for authentication are impacted.
💻 Affected Systems
- Any RADIUS server/client implementing RFC 2865 with MD5 Response Authenticator
📦 What is this software?
Freeradius by Freeradius
Sonicos by Sonicwall
⚠️ Risk & Real-World Impact
Worst Case
Complete authentication bypass allowing unauthorized network access, privilege escalation, or denial of service by manipulating Access-Accept, Access-Reject, or Access-Challenge responses.
Likely Case
Local attackers on the network can forge RADIUS responses to gain unauthorized access to protected resources or disrupt legitimate authentication flows.
If Mitigated
With proper network segmentation and monitoring, impact is limited to isolated network segments, but authentication integrity remains compromised.
🎯 Exploit Status
Requires local network access to intercept/modify RADIUS traffic. MD5 collision attacks are well-documented and tools exist, making exploitation feasible for skilled attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Varies by vendor - check specific RADIUS implementation
Vendor Advisory: http://www.openwall.com/lists/oss-security/2024/07/09/4
Restart Required: Yes
Instructions:
1. Check vendor advisories for your RADIUS implementation. 2. Apply patches that implement stronger cryptographic algorithms. 3. Restart RADIUS services. 4. Consider migrating to RADIUS/TLS or alternative authentication protocols.
🔧 Temporary Workarounds
Enable RADIUS over TLS (RadSec)
allEncrypts RADIUS traffic to prevent interception and modification
# Configure RADIUS server to use TLS
# Example for FreeRADIUS: Enable RadSec in radiusd.conf
Implement network segmentation
linuxIsolate RADIUS traffic to trusted networks only
# Use firewall rules to restrict RADIUS traffic
# Example: iptables -A INPUT -p udp --dport 1812 -s trusted_network -j ACCEPT
🧯 If You Can't Patch
- Segment RADIUS traffic to isolated VLANs with strict access controls
- Implement additional authentication factors beyond RADIUS alone
🔍 How to Verify
Check if Vulnerable:
Check if RADIUS implementation uses MD5 for Response Authenticator per RFC 2865. Review configuration files for authentication method settings.Check Version:
# Check RADIUS server version
radiusd -v
# Or check package version
rpm -q freeradiusVerify Fix Applied:
Verify RADIUS implementation no longer uses MD5 Response Authenticator and has been updated to use stronger cryptographic algorithms.📡 Detection & Monitoring
Log Indicators:
- Unexpected authentication successes/failures
- RADIUS response modifications
- MD5-related warnings in logs
Network Indicators:
- Unusual RADIUS traffic patterns
- RADIUS packets with modified authenticators
- Traffic from unexpected sources to RADIUS ports
SIEM Query:
source="radius.log" AND (event_type="authentication" AND result="success" FROM untrusted_ip) OR (message="MD5" AND "warning")🔗 References
- http://www.openwall.com/lists/oss-security/2024/07/09/4
- https://cert-portal.siemens.com/productcert/html/ssa-723487.html
- https://cert-portal.siemens.com/productcert/html/ssa-794185.html
- https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/
- https://datatracker.ietf.org/doc/html/rfc2865
- https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014
- https://www.blastradius.fail/
- http://www.openwall.com/lists/oss-security/2024/07/09/4
- https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/
- https://datatracker.ietf.org/doc/html/rfc2865
- https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014
- https://security.netapp.com/advisory/ntap-20240822-0001/
- https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol
- https://www.blastradius.fail/
- https://www.kb.cert.org/vuls/id/456537
