Vulnerability · Published Jul 9, 2024 · Assigned by certcc
CVE-2024-3596RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.
Critical 9.0
In plain English
A critical-severity security flaw in RFC from IETF. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 14.9% (higher than 97% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)9.0Critical
Exploit odds (30 days)14.9%top 3.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | freeradius | 3.0.20-15.module_el8.10.0+3873+5b7fed0f | ALSA-2024:4936 |
| AlmaLinux:9 | freeradius | 3.0.21-40.el9_4 | ALSA-2024:4935 |
| AlmaLinux:8 | freeradius-devel | 3.0.20-15.module_el8.10.0+3873+5b7fed0f | ALSA-2024:4936 |
| AlmaLinux:9 | freeradius-devel | 3.0.21-40.el9_4 | ALSA-2024:4935 |
| AlmaLinux:8 | freeradius-doc | 3.0.20-15.module_el8.10.0+3873+5b7fed0f | ALSA-2024:4936 |
| AlmaLinux:9 | freeradius-doc | 3.0.21-40.el9_4 | ALSA-2024:4935 |
| AlmaLinux:8 | freeradius-krb5 | 3.0.20-15.module_el8.10.0+3873+5b7fed0f | ALSA-2024:4936 |
| AlmaLinux:9 | freeradius-krb5 | 3.0.21-40.el9_4 | ALSA-2024:4935 |
| AlmaLinux:8 | freeradius-ldap | 3.0.20-15.module_el8.10.0+3873+5b7fed0f | ALSA-2024:4936 |
| AlmaLinux:9 | freeradius-ldap | 3.0.21-40.el9_4 | ALSA-2024:4935 |
| AlmaLinux:8 | freeradius-mysql | 3.0.20-15.module_el8.10.0+3873+5b7fed0f | ALSA-2024:4936 |
| AlmaLinux:9 | freeradius-mysql | 3.0.21-40.el9_4 | ALSA-2024:4935 |
| AlmaLinux:8 | freeradius-perl | 3.0.20-15.module_el8.10.0+3873+5b7fed0f | ALSA-2024:4936 |
| AlmaLinux:9 | freeradius-perl | 3.0.21-40.el9_4 | ALSA-2024:4935 |
| AlmaLinux:8 | freeradius-postgresql | 3.0.20-15.module_el8.10.0+3873+5b7fed0f | ALSA-2024:4936 |
| AlmaLinux:9 | freeradius-postgresql | 3.0.21-40.el9_4 | ALSA-2024:4935 |
| AlmaLinux:8 | freeradius-rest | 3.0.20-15.module_el8.10.0+3873+5b7fed0f | ALSA-2024:4936 |
| AlmaLinux:9 | freeradius-rest | 3.0.21-40.el9_4 | ALSA-2024:4935 |
| AlmaLinux:8 | freeradius-sqlite | 3.0.20-15.module_el8.10.0+3873+5b7fed0f | ALSA-2024:4936 |
| AlmaLinux:9 | freeradius-sqlite | 3.0.21-40.el9_4 | ALSA-2024:4935 |
| AlmaLinux:8 | freeradius-unixODBC | 3.0.20-15.module_el8.10.0+3873+5b7fed0f | ALSA-2024:4936 |
| AlmaLinux:9 | freeradius-unixODBC | 3.0.21-40.el9_4 | ALSA-2024:4935 |
| AlmaLinux:8 | freeradius-utils | 3.0.20-15.module_el8.10.0+3873+5b7fed0f | ALSA-2024:4936 |
| AlmaLinux:9 | freeradius-utils | 3.0.21-40.el9_4 | ALSA-2024:4935 |
| AlmaLinux:8 | krb5-devel | 1.18.2-30.el8_10 | ALSA-2024:8860 |
| AlmaLinux:9 | krb5-devel | 1.21.1-4.el9_5 | ALSA-2024:9474 |
| AlmaLinux:8 | krb5-libs | 1.18.2-30.el8_10 | ALSA-2024:8860 |
| AlmaLinux:9 | krb5-libs | 1.21.1-4.el9_5 | ALSA-2024:9474 |
| AlmaLinux:8 | krb5-pkinit | 1.18.2-30.el8_10 | ALSA-2024:8860 |
| AlmaLinux:9 | krb5-pkinit | 1.21.1-4.el9_5 | ALSA-2024:9474 |
| AlmaLinux:8 | krb5-server | 1.18.2-30.el8_10 | ALSA-2024:8860 |
| AlmaLinux:9 | krb5-server | 1.21.1-4.el9_5 | ALSA-2024:9474 |
| AlmaLinux:8 | krb5-server-ldap | 1.18.2-30.el8_10 | ALSA-2024:8860 |
| AlmaLinux:9 | krb5-server-ldap | 1.21.1-4.el9_5 | ALSA-2024:9474 |
| AlmaLinux:8 | krb5-workstation | 1.18.2-30.el8_10 | ALSA-2024:8860 |
| AlmaLinux:9 | krb5-workstation | 1.21.1-4.el9_5 | ALSA-2024:9474 |
| AlmaLinux:8 | libkadm5 | 1.18.2-30.el8_10 | ALSA-2024:8860 |
| AlmaLinux:9 | libkadm5 | 1.21.1-4.el9_5 | ALSA-2024:9474 |
| AlmaLinux:8 | python3-freeradius | 3.0.20-15.module_el8.10.0+3873+5b7fed0f | ALSA-2024:4936 |
| AlmaLinux:9 | python3-freeradius | 3.0.21-40.el9_4 | ALSA-2024:4935 |
| Alpine:v3.20 | freeradius | 3.0.27-r0 | ALPINE-CVE-2024-3596 |
| Alpine:v3.21 | freeradius | 3.0.27-r0 | ALPINE-CVE-2024-3596 |
| Alpine:v3.22 | freeradius | 3.0.27-r0 | ALPINE-CVE-2024-3596 |
| Alpine:v3.23 | freeradius | 3.0.27-r0 | ALPINE-CVE-2024-3596 |
| Alpine:v3.24 | freeradius | 3.0.27-r0 | ALPINE-CVE-2024-3596 |
| Debian:12 | freeradius | no fix listed | DEBIAN-CVE-2024-3596 |
| Debian:13 | freeradius | 3.2.5+dfsg-1 | DEBIAN-CVE-2024-3596 |
| Debian:14 | freeradius | 3.2.5+dfsg-1 | DEBIAN-CVE-2024-3596 |
| Rocky Linux:8 | freeradius | 0:3.0.20-15.module+el8.10.0+1841+f214069a | RLSA-2024:4936 |
| Rocky Linux:9 | freeradius | 0:3.0.21-40.el9_4 | RLSA-2024:4935 |
| Rocky Linux:8 | krb5 | 0:1.18.2-30.el8_10 | RLSA-2024:8860 |
| Rocky Linux:9 | krb5 | 0:1.21.1-4.el9_5 | RLSA-2024:9474 |
| Ubuntu:22.04:LTS | freeradius | 3.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu3.3 | UBUNTU-CVE-2024-3596 |
| Ubuntu:22.04:LTS | freeradius | 3.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu3.3 | USN-7055-1 |
| Ubuntu:24.04:LTS | freeradius | 3.2.5+dfsg-3~ubuntu24.04.1 | USN-7055-1 |
| Ubuntu:24.04:LTS | freeradius | 3.2.5+dfsg-3~ubuntu24.04.1 | UBUNTU-CVE-2024-3596 |
| Ubuntu:22.04:LTS | krb5 | 1.19.2-2ubuntu0.5 | USN-7257-1 |
| Ubuntu:22.04:LTS | krb5 | 1.19.2-2ubuntu0.5 | UBUNTU-CVE-2024-3596 |
| Ubuntu:24.04:LTS | krb5 | 1.20.1-6ubuntu2.3 | USN-7257-1 |
| Ubuntu:24.04:LTS | krb5 | 1.20.1-6ubuntu2.3 | UBUNTU-CVE-2024-3596 |
| Ubuntu:22.04:LTS | libpam-radius-auth | no fix listed | UBUNTU-CVE-2024-3596 |
| Ubuntu:24.04:LTS | libpam-radius-auth | no fix listed | UBUNTU-CVE-2024-3596 |
Affected products (as reported)
References
- https://datatracker.ietf.org/doc/html/rfc2865
- https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/
- https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf
- https://www.blastradius.fail/
- http://www.openwall.com/lists/oss-security/2024/07/09/4
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0014
- Siemens Security Advisory by Siemens ProductCERT for SIPROTEC, SICAM and related product vendor-advisory
- Siemens Security Advisory by Siemens ProductCERT to SCALANCE, RUGGEDCOM and related products. vendor-advisory
- https://security.netapp.com/advisory/ntap-20240822-0001/
- https://today.ucsd.edu/story/computer-scientists-discover-vulnerabilities-in-a-popular-security-protocol
- https://www.kb.cert.org/vuls/id/456537
- https://cert-portal.siemens.com/productcert/html/ssa-364175.html
- https://cert-portal.siemens.com/productcert/html/ssa-770770.html