[ISN] New RADIUS vulns exposed

From: InfoSec News (isnat_private)
Date: Wed Mar 06 2002 - 00:29:13 PST

  • Next message: InfoSec News: "RE: [ISN] Digital Destruction Was Worst Imaginable"

    By Thomas C Greene in Washington
    Posted: 05/03/2002 at 20:46 GMT
    Numerous holes in the ubiquitous RADIUS (remote authentication dial-in
    user service) protocol can be exploited with results including denial
    of service and running arbitrary code on the target device, a Russian
    security researcher has demonstrated. The risk of the DoS attack is
    considerably greater, and can be achieved two ways.
    First up, according to a bulletin [1] by '3APA3A', during
    authentication in several implementations a digest is created
    consisting of an initial packet, a message authenticator and a shared
    secret concatenated and calculated as an MD5 hash. Unfortunately, the
    process doesn't check for adequate space in the target buffer. Thus a
    shared secret can be used to overload the buffer, and cause a denial
    of service.
    If the shared secret were accurately guessed, an attacker could get
    privileges on the target RADIUS client or server. While this is far
    from a trivial exercise, we note that according to [2] researcher
    Joshua Hill, "most client and server implementations only allow shared
    secrets to be input as ASCII strings. There are only 94 different
    ASCII characters that can be entered from a standard US style keyboard
    (out of the 256 possible). Many implementations also restrict the
    total length of the shared secret to 16 characters or less. Both of
    these restrictions artificially reduce the size of the keyspace that
    an attacker must search in order to guess the shared secret."
    Next up, still following the 3APA3A bulletin, we have improper
    validation of a vendor-specific attribute. Vendor-specific and
    user-specific attributes can be passed to the client. If the
    vendor-specific header contains less than two bytes, it will be
    calculated as a negative number and a denial of service will result.  
    It is not necessary to know the shared secret to abuse this flaw.
    RADIUS is used widely by ISPs and NSPs for remote user authentication,
    so these issues are likely to affect a large number of admins and a
    vast heap of equipment and software. It's ubiquitous chiefly because
    it's embedded in numerous devices such as routers and switches.
    3APA3A has a simple tool for testing RADIUS vulnerabilities available
    here [3].
    CERT has a bulletin listing all equipment and software presently known
    to be vulnerable, along with links to the vendors, posted here [4].
    [1] http://www.security.nnov.ru/advisories/radius.asp
    [2] http://www.untruth.org/~josh/security/radius/radius-auth.html
    [3] http://www.security.nnov.ru/files/test_radius.c
    [4] http://www.cert.org/advisories/CA-2002-06.html
    ISN is currently hosted by Attrition.org
    To unsubscribe email majordomoat_private with 'unsubscribe isn' in the BODY
    of the mail.

    This archive was generated by hypermail 2b30 : Wed Mar 06 2002 - 03:37:20 PST