¡¾Îó²îͨ¸æ¡¿RADIUSÐÒéÓÕÆÎó²î£¨CVE-2024-3596£©
Ðû²¼Ê±¼ä 2024-07-10Ò»¡¢Îó²î¸ÅÊö
Îó²îÃû³Æ | RADIUSÐÒéÓÕÆÎó²î | ||
CVE ID | CVE-2024-3596 | ||
Îó²îÀàÐÍ | αÔì¡¢MITM | ·¢Ã÷ʱ¼ä | 2024-07-10 |
Îó²îÆÀ·Ö | 7.5 | Îó²îÆ·¼¶ | ¸ßΣ |
¹¥»÷ÏòÁ¿ | ÍøÂç | ËùÐèȨÏÞ | µÍ |
ʹÓÃÄÑ¶È | ¸ß | Óû§½»»¥ | ÎÞ |
PoC/EXP | δ¹ûÕæ | ÔÚҰʹÓà | δ·¢Ã÷ |
RADIUSÐÒéÊÇÒ»ÖÖÓÃÓÚÔÚÍøÂç½ÓÈëЧÀÍÆ÷£¨NAS£©ºÍÈÏÖ¤¡¢ÊÚȨ¡¢¼Æ·Ñ£¨AAA£©Ð§ÀÍÆ÷Ö®¼ä´«ÊäÓû§ÈÏÖ¤¡¢ÊÚȨºÍ¼Æ·ÑÐÅÏ¢µÄÐÒé¡£¡£¡£¡£¡£Ëüͨ¹ý¿Í»§¶ËºÍЧÀÍÆ÷Ö®¼äµÄͨѶÀ´ÑéÖ¤Óû§µÄÉí·Ý£¬£¬£¬£¬£¬²¢¾öÒéÓû§ÊÇ·ñÓÐȨ»á¼ûÍøÂç×ÊÔ´¡£¡£¡£¡£¡£
2024Äê7ÔÂ10ÈÕ£¬£¬£¬£¬£¬¼øºÚµ£±£Íø¼¯ÍÅVSRC¼à²âµ½RFC 2865ϵÄRADIUSÐÒé/UDP±»Åû¶±£´æÎ±Ôì¹¥»÷/ÓÕÆÎó²î£¨CVE-2024-3596£¬£¬£¬£¬£¬±»³ÆÎªBlast-RADIUS£©£¬£¬£¬£¬£¬ÏÖÔÚ¸ÃÎó²îµÄÊÖÒÕϸ½ÚÒѹûÕæ¡£¡£¡£¡£¡£
RADIUS ЧÀÍÆ÷µÄRADIUSÏìÓ¦ÑéÖ¤Öб£´æÎó²î£¬£¬£¬£¬£¬¸ÃÎó²îÔ´ÓÚÑéÖ¤RADIUSЧÀÍÆ÷µÄÉí·ÝÑéÖ¤ÏìӦʱʹÓÃÁ˼ÓÃÜÉϲ»Çå¾²µÄÍêÕûÐÔ¼ì²éÒªÁ죬£¬£¬£¬£¬ÖÐÐÄÈ˹¥»÷Õß¿ÉÒÔ»á¼û´«Êä RADIUS ÐÒéµÄÍøÂ磬£¬£¬£¬£¬ÔÚ²»ÐèÒª»ò²»Ç¿ÖÆÊ¹Óà Message-Authenticator ÊôÐÔµÄÇéÐÎÏÂαÔì»ùÓÚUDPµÄRADIUSÏìÓ¦Êý¾Ý°ü£¬£¬£¬£¬£¬½«ÈκÎÓÐÓÃÏìÓ¦£¨»á¼û½ÓÊÜ¡¢»á¼û¾Ü¾ø»ò»á¼ûÖÊѯ£©ÐÞ¸ÄΪÈÎºÎÆäËûÏìÓ¦¡£¡£¡£¡£¡£
¶þ¡¢Ó°Ïì¹æÄ£
RFC 2865ÏÂËùÓÐʹÓÃUDPÉϵķÇEAPÉí·ÝÑéÖ¤ÒªÁìµÄRADIUSʵÏÖ
×¢£º½öÖ´ÐÐ RFC 3579 ÖÐÖ¸¶¨µÄ¿ÉÀ©Õ¹Éí·ÝÑéÖ¤ÐÒé (EAP) µÄ RADIUS ЧÀÍÆ÷²»ÊܸÃÎó²îÓ°Ï죬£¬£¬£¬£¬EAP Éí·ÝÑéÖ¤ÐÂÎÅÐèÒª Message-Authenticator ÊôÐÔ£¬£¬£¬£¬£¬¿É×èÖ¹¹¥»÷¡£¡£¡£¡£¡£Ê¹Óà TLS£¨»ò DTLS£©¼ÓÃÜÒ²¿ÉÒÔ×èÖ¹´ËÀ๥»÷¡£¡£¡£¡£¡£
Èý¡¢Çå¾²²½·¥
3.1 Éý¼¶°æ±¾
À¦°ó¿ªÔ´ RADIUS ʵÏÖ£¨ÈçFreeRadius£©µÄÖÆÔìÉÌÓ¦½«¿Í»§¶ËºÍЧÀÍÆ÷µÄÈí¼þ¸üе½×îпÉÓÃÈí¼þ£¬£¬£¬£¬£¬²¢ÇÒÖÁÉÙÒªÇóʹÓà Message-Authenticator ¾ÙÐÐ RADIUS Éí·ÝÑéÖ¤¡£¡£¡£¡£¡£ÏÖÔÚFreeRADIUSÒÑÌṩÁË3.0.27 ºÍ 3.2.5°æ±¾µÄÔ¤¹¹½¨Èí¼þ°ü£¬£¬£¬£¬£¬ÏÂÔØÁ´½Ó£º
https://www.networkradius.com/packages/
ÒÀÀµ»ùÓÚ RADIUS µÄÐÒé¾ÙÐÐ×°±¸»òÓû§Éí·ÝÑéÖ¤µÄÍøÂçÔËÓªÉÌÓ¦½«ÆäÈí¼þºÍÉèÖøüÐÂΪ¿Í»§¶ËºÍЧÀÍÆ÷µÄÇå¾²ÐÒéÐÎʽ¡£¡£¡£¡£¡£Õâ¿ÉÒÔͨ¹ýÇ¿ÖÆÊµÑé TLS »ò DTLS ¼ÓÃÜÀ´±£»£»£»¤ RADIUS ¿Í»§¶ËºÍЧÀÍÆ÷Ö®¼äµÄͨѶÀ´ÊµÏÖ¡£¡£¡£¡£¡£ÔÚ¿ÉÄܵÄÇéÐÎÏ£¬£¬£¬£¬£¬Ó¦Îª RADIUS ÐÒéÇ¿ÖÆÊµÑéÍøÂç¸ôÀëºÍÇå¾² VPN ËíµÀͨѶ£¬£¬£¬£¬£¬ÒÔÏÞÖÆ²»ÊÜÐÅÈεÄȪԴ¶ÔÕâÐ©ÍøÂç×ÊÔ´µÄ»á¼û¡£¡£¡£¡£¡£
΢ÈíÒÑÔÚ7Ô²¹¶¡ÖÐÌṩÁËÊÜÓ°Ïì Windows °æ±¾µÄÇå¾²¸üÐÂÐÞ¸´Á˸ÃÎó²î£¬£¬£¬£¬£¬¿É²Î¿¼£º
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-3596
3.2 ÔÝʱ²½·¥
ÈôÊÇϵͳʹÓà PAP¡¢CHAP »ò MS-CHAP over RADIUS/UDP£¬£¬£¬£¬£¬ÔòÐèÒªÉý¼¶ FreeRADIUS£¬£¬£¬£¬£¬È»ºóʹÓÃеÄÉèÖñê¼ÇÖØÐÂÉèÖÃËü£¬£¬£¬£¬£¬¿É²Î¿¼:
https://www.freeradius.org/security/
3.3 ͨÓý¨Òé
l °´ÆÚ¸üÐÂϵͳ²¹¶¡£¡£¡£¡£¡£¬£¬£¬£¬£¬ïÔÌϵͳÎó²î£¬£¬£¬£¬£¬ÌáÉýЧÀÍÆ÷µÄÇå¾²ÐÔ¡£¡£¡£¡£¡£
l ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬£¬£¬£¬£¬Ð޸ķÀ»ðǽսÂÔ£¬£¬£¬£¬£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻòЧÀÍ£¬£¬£¬£¬£¬ïÔ̽«Î£ÏÕЧÀÍ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬£¬£¬£¬£¬ïÔ̹¥»÷Ãæ¡£¡£¡£¡£¡£
l ʹÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬£¬£¬£¬£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£¡£¡£¡£¡£
l ÔöǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬£¬£¬£¬£¬ÆôÓöàÒòËØÈÏÖ¤»úÖÆºÍ×îСȨÏÞÔÔò£¬£¬£¬£¬£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏÞ¶È¡£¡£¡£¡£¡£
l ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£¡£¡£¡£¡£
3.4 ²Î¿¼Á´½Ó
https://www.blastradius.fail/
https://www.blastradius.fail/pdf/radius.pdf
https://kb.cert.org/vuls/id/456537
https://www.freeradius.org/security/
https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/
ËÄ¡¢°æ±¾ÐÅÏ¢
°æ±¾ | ÈÕÆÚ | ±¸×¢ |
V1.0 | 2024-07-10 | Ê×´ÎÐû²¼ |
Îå¡¢¸½Â¼
5.1 ¼øºÚµ£±£Íø¼ò½é
¼øºÚµ£±£Íø½¨ÉèÓÚ1996Ä꣬£¬£¬£¬£¬ÊÇÓÉÁôÃÀ²©Ê¿ÑÏÍû¼ÑŮʿ½¨ÉèµÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÐÅÏ¢Çå¾²¸ß¿Æ¼¼ÆóÒµ¡£¡£¡£¡£¡£ÊǺ£ÄÚ×î¾ßʵÁ¦µÄÐÅÏ¢Çå¾²²úÆ·¡¢Ç徲ЧÀͽâ¾ö¼Æ»®µÄÁ캽ÆóÒµÖ®Ò»¡£¡£¡£¡£¡£
¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°¼øºÚµ£±£Íø´óÏ㬣¬£¬£¬£¬¹«Ë¾Ô±¹¤6000ÓàÈË£¬£¬£¬£¬£¬Ñз¢ÍŶÓ1200ÓàÈË, ÊÖÒÕЧÀÍÍŶÓ1300ÓàÈË¡£¡£¡£¡£¡£ÔÚÌìϸ÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÁ¢·ÖÖ§»ú¹¹ÁùÊ®¶à¸ö£¬£¬£¬£¬£¬ÓµÓÐÁýÕÖÌìϵÄÏúÊÛϵͳ¡¢ÇþµÀϵͳºÍÊÖÒÕÖ§³Öϵͳ¡£¡£¡£¡£¡£¹«Ë¾ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉîÛÚÖÐС°å¹ÒÅÆÉÏÊС£¡£¡£¡£¡££¨¹ÉƱ´úÂ룺002439£©
¶àÄêÀ´£¬£¬£¬£¬£¬¼øºÚµ£±£ÍøÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷Á¢ÒìµÄÇå¾²²úÆ·ºÍ×î¼Ñʵ¼ùЧÀÍ£¬£¬£¬£¬£¬×ÊÖú¿Í»§ÖÜÈ«ÌáÉýÆäIT»ù´¡ÉèÊ©µÄÇå¾²ÐÔºÍÉú²úЧÄÜ£¬£¬£¬£¬£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Çå¾²¹¤ÒµÁì¾üÆ·ÅÆ¶ø²»Ð¸Æð¾¢¡£¡£¡£¡£¡£
5.2 ¹ØÓÚ¼øºÚµ£±£Íø
¼øºÚµ£±£ÍøÇå¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÒÑÐû²¼1000¶à¸öÎó²îͨ¸æºÍΣº¦Ô¤¾¯£¬£¬£¬£¬£¬ÎÒÃǽ«Ò»Á¬¸ú×ÙÈ«Çò×îеÄÍøÂçÇå¾²ÊÂÎñºÍÎó²î£¬£¬£¬£¬£¬ÎªÆóÒµµÄÐÅÏ¢Çå¾²±£¼Ý»¤º½¡£¡£¡£¡£¡£
¹Ø×¢ÎÒÃÇ£º