RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.

CERT/CC: CVE-2024-3596 RADIUS Protocol Spoofing Vulnerability

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a ...

Security update for freeradius-server

Security update for freeradius-server

Security update for freeradius-server

Security update for freeradius-server

Important: krb5 security update

Important: krb5 security update

Important: freeradius security update

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.

ELSA-2024-9474: krb5 security update (IMPORTANT)

ELSA-2024-8860: krb5 security update (IMPORTANT)

ELSA-2024-8788: krb5 security update (IMPORTANT)

ELSA-2024-4936: freeradius:3.0 security update (IMPORTANT)

ELSA-2024-4935: freeradius security update (IMPORTANT)

ELSA-2024-4911: freeradius security update (IMPORTANT)

Уязвимость реализации протокола аутентификации RADIUS связана с обходом процедуры аутентификации посредством захвата-воспроизведения (capture-replay) перехваченных сообщений. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, получить несанкционированный доступ путём подделки аутентификационного ответа