TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

RADIUS protocol susceptible to forgery attacks

63 点作者 byproxy10 个月前

3 条评论

banish-m410 个月前
RADIUS, LDAP, DIAMETER, sflow, TACAS+, SNMP (all versions), UPS, lights-out management, and similar should never-ever be deployed to public-facing networks. These should remain segregated on internal VLANs used for infrastructure only.<p>For wireless 802.1x, use clients certs; managed campus APs may still need a tunnel to a RADIUS box, but that&#x27;s okay.
twojacobtwo10 个月前
Mitigation:<p>&gt; Our recommended short-term mitigation for implementers and vendors is to mandate that clients and servers always send and require Message-Authenticator attributes for all requests and responses. For Access-Accept or Access-Reject responses, the Message-Authenticator should be included as the first attribute. Patches implementing this mitigation have been implemented by all RADIUS implementations that we are aware of. This guidance is being put into an upcoming RADIUS RFC.<p>Paper:<p>&gt; &quot;Radius&#x2F;UDP Considered Harmful&quot; <i>Sharon Goldberg, Miro Haller, Nadia Heninger, Mike Milano, Dan Shumow, Marc Stevens, and Adam Suhl</i><p>&gt; <a href="https:&#x2F;&#x2F;www.blastradius.fail&#x2F;pdf&#x2F;radius.pdf" rel="nofollow">https:&#x2F;&#x2F;www.blastradius.fail&#x2F;pdf&#x2F;radius.pdf</a>
评论 #40924136 未加载
jgrahamc10 个月前
Write up on the Cloudflare blog: <a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;radius-udp-vulnerable-md5-attack" rel="nofollow">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;radius-udp-vulnerable-md5-attack</a>