CVE-2024-3596

RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.

Published Jul 9, 2024 CVSS 3.1 · 9 Critical EPSS 14.9% KEV · Not listed
Description
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Ubuntu USN Ubuntu USN USN-7055-1 FreeRADIUS vulnerability
Ubuntu USN Ubuntu USN USN-7257-1 Kerberos vulnerability
History
Type Values Removed Values Added
Weaknesses CWE-200
CWE-328
Type Values Removed Values Added
Metrics epss

{'score': 0.00774}

epss

{'score': 0.00888}

Type Values Removed Values Added
Weaknesses CWE-200
CWE-328
Type Values Removed Values Added
First Time appeared Ietf
Ietf rfc
CPEs cpe:2.3:a:ietf:rfc:2865:*:*:*:*:*:*:*
Vendors & Products Ietf
Ietf rfc
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
First Time appeared Redhat openshift Ai
CPEs cpe:/a:redhat:openshift_ai:2.16::el8
Vendors & Products Redhat openshift Ai
Type Values Removed Values Added
First Time appeared Broadcom
Broadcom brocade Sannav
Broadcom fabric Operating System
Freeradius
Freeradius freeradius
Sonicwall
Sonicwall sonicos
Weaknesses CWE-354
CPEs cpe:2.3:a:broadcom:brocade_sannav:-:*:*:*:*:*:*:*
cpe:2.3:a:freeradius:freeradius:*:*:*:*:*:*:*:*
cpe:2.3:o:broadcom:fabric_operating_system:-:*:*:*:*:*:*:*
cpe:2.3:o:sonicwall:sonicos:-:*:*:*:*:*:*:*
Vendors & Products Broadcom
Broadcom brocade Sannav
Broadcom fabric Operating System
Freeradius
Freeradius freeradius
Sonicwall
Sonicwall sonicos
Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_eus:9.4
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:8
Type Values Removed Values Added
CPEs cpe:/o:redhat:rhel_aus:8.6
cpe:/o:redhat:rhel_e4s:8.6
cpe:/o:redhat:rhel_eus:8.8
cpe:/o:redhat:rhel_tus:8.6
Type Values Removed Values Added
CPEs cpe:/o:redhat:rhel_aus:8.2
cpe:/o:redhat:rhel_aus:8.4
cpe:/o:redhat:rhel_e4s:8.4
cpe:/o:redhat:rhel_tus:8.4