Vulnerability Note VU#589523

Multiple implementations of the RADIUS protocol contain a digest calculation buffer overflow

Overview

Multiple implementations of the RADIUS protocol contain a buffer overflow in the function that calculates message digests.

I. Description

During the message digest calculation, a string containing the shared secret is concatenated with a packet received without checking the size of the target buffer. This makes it possible to overflow the buffer with shared secret data. This can lead to denial of service against the server. If the shared secret is known by the attacker, then it may be possible to use this information to execute arbitrary code with the privileges of the victim RADIUS server or client, usually root. It should be noted that gaining knowledge of the shared secret is not a trivial task.

Certain implementations of RADIUS vulnerable to VU#589523 may allow the execution of code if multiple packets are processed in the same thread, and the last 1 or 2 bytes of the shared secret is with in a certain range. In this case, specific knowledge of the shared secret is not required.

II. Impact

Without knowledge of the shared secret, an attacker can cause a denial of service against the server, or the client via the server response. With knowledge of the shared secret, an attacker may be able to execute arbitrary code. In certain implementations, specific knowledge of the shared secret is not required to execute arbitrary code if the last 1 or 2 bytes of the shared secret are with in a certain range.

III. Solution

Apply a patch or upgrade to the version specified by your vendor.

Implementing a firewall to filter packets from outside of your network perimeter from being sent to the RADIUS server may help reduce the risk of attack. Note that this is not sufficient to prevent the vulnerability from being exploited by users who are within your network perimeter.

Systems Affected

Vendor	Status	Date Updated
Alcatel	Not Vulnerable	2-Apr-2002
Apple	Not Vulnerable	19-Feb-2002
Athena Online	Not Vulnerable	12-Mar-2002
Cisco	Not Vulnerable	4-Mar-2002
Cistron	Vulnerable	19-Feb-2002
Conectiva	Vulnerable	7-Mar-2002
FreeBSD	Vulnerable	20-Feb-2002
FreeRADIUS	Vulnerable	27-Feb-2002
Fujitsu	Not Vulnerable	20-Feb-2002
Funk Software	Not Vulnerable	28-Mar-2002
GnuRADIUS	Vulnerable	20-Feb-2002
Hewlett Packard	Not Vulnerable	20-Feb-2002
IBM	Not Vulnerable	20-Feb-2002
ICRADIUS	Vulnerable	20-Feb-2002
Interlink Networks	Not Vulnerable	18-Mar-2002
Juniper Networks	Not Vulnerable	20-Feb-2002
Lucent	Vulnerable	5-Mar-2002
Microsoft	Not Vulnerable	20-Feb-2002
NETBSD	Vulnerable	20-Feb-2002
Novell	Vulnerable	12-Apr-2002
Open System Consultants	Not Vulnerable	12-Mar-2002
Process Software	Not Vulnerable	20-Feb-2002
RADIUS	Vulnerable	4-Mar-2002
RADIUSClient	Vulnerable	20-Feb-2002
Red Hat	Vulnerable	20-Feb-2002
Riverstone Networks	Not Vulnerable	13-Mar-2002
SCO	Not Vulnerable	19-Feb-2002
Secure Computing Corporation	Vulnerable	16-Apr-2002
SGI	Not Vulnerable	20-Feb-2002
Vircom	Vulnerable	2-Apr-2002
Wind River Systems	Not Vulnerable	4-Mar-2002
XTRADIUS	Vulnerable	20-Feb-2002
YARD RADIUS	Vulnerable	20-Feb-2002

References

http://www.untruth.org/~josh/security/radius
http://www.securityfocus.com/bid/3530

Credit

Our thanks to Joshua Hill <josh-radius@untruth.org> and 3APA3A <3APA3A@SECURITY.NNOV.RU> for their report and analysis of this vulnerability.

This document was written by Jason Rafail and is based on information provided by 3APA3A.

Other Information

Date Public	11/12/2001
Date First Published	03/04/2002 02:27:56 PM
Date Last Updated	04/16/2002
CERT Advisory	CA-2002-06
CVE Name
US-CERT Technical Alerts
Metric	5.74
Document Revision	21

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Get Adobe Reader