Stormshield Network Security

CVSS v3.1 Overall Score: 5.5      

Analysis

Impacted version

RADIUS Protocol under RFC 2865, which is used on SNS, is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature.

• SNS 3.7.0 to 3.7.42
• SNS 3.10.0 to 3.11.30
• SNS 4.0.0 to 4.3.29
• SNS 4.4.0 to 4.7.8
• SNS 4.8.0 to 4.8.2

Workaround solution

Solution

There is no workaround solution.

The following SNS versions will fix this vulnerability:

• 4.3.30
• 4.7.9
• 4.8.3

Please note that these firmware versions adds two configuration tokens that are enabled by default:
MsgAuthenticatorSend=1 # if enabled, send the message-authenticator attribute in client requests
MsgAuthenticatorRequired=1 # if enabled, reject any server response that doesn’t contain a message-authenticator attribute

These modifications may have an impact on your Radius authentication politics.

To change the default configuration via CLI commands:
CONFIG.AUTH.RADIUS MsgAuthenticatorSend=0
CONFIG.AUTH.RADIUS MsgAuthenticatorRequired=0

To show current configuration:
CONFIG.AUTH.SHOW