sec.cloudapps.cisco.com Open in urlscan Pro
72.163.15.141  Public Scan

Form analysis
1 forms found in the DOM

Name: pdfGeneration — POST /security/center/downloadPDF.pdf

<form action="/security/center/downloadPDF.pdf" "="" name=" pdfGeneration" method="post">
  <input type="hidden" id="subpageId" value="cisco-sa-radius-spoofing-july-2024-87cCDwZ3" name="tyID">
  <input type="hidden" value="CiscoSecurityAdvisory" name="typeName">
  <input type="hidden" value="Cisco Security Advisory" name="documentType">
  <input type="hidden" value="RADIUS Protocol Spoofing Vulnerability (Blast-RADIUS): July 2024" name="documentTitle">
  <input type="hidden" id="pageId" value="AdvisoryContent">
  <input type="hidden" id="userId" value="">
  <input type="hidden" id="userFirstName" value="">
  <input type="hidden" id="userLastName" value="">
  <input type="hidden" id="appURL" value="https://sec.cloudapps.cisco.com/security/center/">
</form>

Text Content

Home / Cisco Security / Security Advisories





CISCO SECURITY ADVISORY


RADIUS PROTOCOL SPOOFING VULNERABILITY (BLAST-RADIUS): JULY 2024

High
Advisory ID:
cisco-sa-radius-spoofing-july-2024-87cCDwZ3
First Published:
2024 July 10 16:00 GMT
Version 1.0:
Interim
Workarounds:
No workarounds available
CVE-2024-3596

CWE-924

CVSS Score:
Base 8.1Click Icon to Copy Verbose Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:X
CVE-2024-3596

CWE-924


Download CSAF

Email
SUMMARY

 * On July 7, 2024, security researchers disclosed the following vulnerability
   in the RADIUS protocol:
   
   > CVE-2024-3596: RADIUS Protocol under RFC 2865 is susceptible to forgery
   > attacks by an on-path attacker who can modify any valid Response
   > (Access-Accept, Access-Reject, or Access-Challenge) to any other response
   > using a chosen-prefix collision attack against MD5 Response Authenticator
   > signature.
   
   This vulnerability may impact any RADIUS client and server. For a description
   of this vulnerability, see VU#456537: RADIUS protocol susceptible to forgery
   attacks.
   
   This advisory will be updated as additional information becomes available.
   
   This advisory is available at the following link:
   https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-radius-spoofing-july-2024-87cCDwZ3

AFFECTED PRODUCTS

 * Cisco is investigating its product line to determine which products and cloud
   services may be affected by this vulnerability. As the investigation
   progresses, Cisco will update this advisory with information about affected
   products and services.
   
   The Vulnerable Products section will include Cisco bug IDs for each affected
   product or service. The bugs are accessible through the Cisco Bug Search Tool
   and contain additional platform-specific information, including workarounds
   (if available) and fixed software releases.
   
   
   PRODUCTS UNDER INVESTIGATION
   
   The following Cisco products are under active investigation to determine
   whether they are affected by the vulnerability that is described in this
   advisory.
   
    * Adaptive Security Appliance
    * Application Policy Infrastructure Controller (APIC)
    * Catalyst Center
    * Catalyst SD-WAN Controller, formerly SD-WAN vSmart
    * Catalyst SD-WAN Manager, formerly SD-WAN vManage
    * Catalyst SD-WAN Validator, formerly SD-WAN vBond
    * Enterprise NFV Infrastructure
    * Firepower Management Center (FMC)
    * Firepower Threat Defense (FTD)
    * Identity Services Engine (ISE)
    * IOS Software
    * IOS XE Software
    * IOS XR Software
    * Nexus Dashboard, formerly Application Services Engine
    * NX-OS Software
    * Policy Suite
    * Prime Infrastructure
    * SD-WAN vEdge Routers
    * Secure Access Control System
    * Wireless LAN Controller
   
   
   VULNERABLE PRODUCTS
   
   Cisco is investigating its product line to determine which products may be
   affected by this vulnerability and the impact on each affected product. This
   section will be updated as information is available.
   
   
   PRODUCTS CONFIRMED NOT VULNERABLE
   
   Cisco is investigating its product line to determine which products may be
   affected by this vulnerability and the impact on each affected product. This
   section will be updated as information becomes available.

WORKAROUNDS

 * There are no workarounds that address this vulnerability.
   
   RADIUS clients and servers configured to use DTLS or TLS over TCP are not
   exploitable, even if the underlying implementation is otherwise vulnerable,
   as long as the traffic is not sent in plaintext.
   
   Customers should determine the applicability and effectiveness of this
   mitigation in their own environment and under their own use conditions.
   Customers should be aware that any workaround or mitigation that is
   implemented may negatively impact the functionality or performance of their
   network based on intrinsic customer deployment scenarios and limitations.
   Customers should not deploy any workarounds or mitigations before first
   evaluating the applicability to their own environment and any impact to such
   environment.

FIXED SOFTWARE

 * For information about fixed software releases, consult the Cisco bugs
   identified in the Vulnerable Products section of this advisory.
   
   When considering software upgrades, customers are advised to regularly
   consult the advisories for Cisco products, which are available from the Cisco
   Security Advisories page, to determine exposure and a complete upgrade
   solution.
   
   In all cases, customers should ensure that the devices to be upgraded contain
   sufficient memory and confirm that current hardware and software
   configurations will continue to be supported properly by the new release. If
   the information is not clear, customers are advised to contact the Cisco
   Technical Assistance Center (TAC) or their contracted maintenance providers.

EXPLOITATION AND PUBLIC ANNOUNCEMENTS

 * The Cisco PSIRT is aware that proof-of-concept exploit code is available for
   the vulnerability described in this advisory.
   
   The Cisco PSIRT is not aware of any malicious use of the vulnerability that
   is described in this advisory.

SOURCE

 * This vulnerability was publicly disclosed by Sharon Goldberg, Miro Haller,
   Nadia Heninger, Mike Milano, Dan Shumow, Marc Stevens, and Adam Suhl on July
   9, 2024.

CISCO SECURITY VULNERABILITY POLICY

 * To learn about Cisco security vulnerability disclosure policies and
   publications, see the Security Vulnerability Policy. This document also
   contains instructions for obtaining fixed software and receiving security
   vulnerability information from Cisco.

SUBSCRIBE TO CISCO SECURITY NOTIFICATIONS

 * Subscribe

RELATED TO THIS ADVISORY

 * 

URL

 * https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-radius-spoofing-july-2024-87cCDwZ3

REVISION HISTORY

 * Version Description Section Status Date 1.0 Initial public release. - Interim
   2024-JUL-10
   
   Show Less

--------------------------------------------------------------------------------

LEGAL DISCLAIMER

 * THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF
   GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS
   FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR
   MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE
   RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME. CISCO EXPECTS TO UPDATE
   THIS DOCUMENT AS NEW INFORMATION BECOMES AVAILABLE.
   
   A standalone copy or paraphrase of the text of this document that omits the
   distribution URL is an uncontrolled copy and may lack important information
   or contain factual errors. The information in this document is intended for
   end users of Cisco products.

FEEDBACK

 * 
   Leave additional feedback

CISCO SECURITY VULNERABILITY POLICY

 * To learn about Cisco security vulnerability disclosure policies and
   publications, see the Security Vulnerability Policy. This document also
   contains instructions for obtaining fixed software and receiving security
   vulnerability information from Cisco.

SUBSCRIBE TO CISCO SECURITY NOTIFICATIONS

 * Subscribe

RELATED TO THIS ADVISORY

 * 


YOUR RATING:


YOUR RATING:


PLEASE LOG IN TO RATE

Log In Cancel

Average Rating:

5 star


4 star


3 star


2 star


1 star



Leave additional feedback


Feedback