RADIUS Clients, Servers Open to DOS Attacks

There are two remotely exploitable security vulnerabilities in numerous implementations of the RADIUS protocol that enable attackers to launch denial-of-service attacks against both clients and servers.

RADIUS (remote authentication dial-in user service) is used for authentication and authorization in many different network settings, including 802.11b wireless LANs.

Affected versions include FreeRADIUS, Cistron RADIUS, GnuRADIUS and others. Some of the providers of the affected versions have yet to release patches or updated versions of their software.

The first vulnerability is a buffer overflow in the function that calculates message digests. During this operation, the string containing the shared secret used for authentication is concatenated with an incoming packet without regard to the size of the target buffer.

As a result, an attacker can overflow the buffer containing the shared secret data, which can cause a denial of service against the server, according to a CERT Coordination Center bulletin released Monday. Further, if the attacker knows the shared secret—which is unlikely—he can use it to execute code on the machine at the users privilege level.

The second vulnerability is a flaw in the way that RADIUS servers and clients pass vendor-specific and user-specific attributes. Some implementations fail to check the length of the vendor-specific attributes, which can lead to a denial of service, CERT said.

For a full list of the affected vendors and versions, check the CERT Web site at www.cert.org.