Security Advisories
IAC-2024-0062024-07–15Radius vulnerability
Who is affected?
Only systems with activated external authentication method Radius or iPass are affected as plain Radius (without EAP) is in use.
- Note that Radius can also be used as authentication method for WebAdmin logins which is also affected.
- Radius as part of 802.1x is not affected as EAP should always be in use there.
There's a possible MITM attack that can change a denied authentication into a successful authentication.
The attacker needs to craft a matching MD5-HMAC within the clients timeout, so this needs resources and time, so this is not easy to exploit.
Changes
- From now on Radius requests always have the Message-Authenticator attribute set
- There's a new Radius setting in WebAdmin under Login Methods -> External Authentication -> Radius: Force Message Authenticationwhich checks if a Radius response has the attribute Message-Authenticator.
This new option has to be switched on manually as it's maybe not backwards compatible with your Radius server that does not send this attribute.
Further Information
See the blastradius.fail page for more details
IAC-2024-0052024-07–15Multiple webserver vulnerabilities
As some of the vulnerabilities allow DoS attacks, all users are advised to update their systems to 21.0-p21566.
IAC-2024-0042024-07–03OpenSSH regreSSHion vulnerability
See all details in the Qualys report (regreSSHion)
Workaround for systems that can't be updated right now: Disable SSH access from all interfaces or add rules to your firewall so that SSH port (TCP/22) is not reachable.
IAC-2024-0032024-04–12Linux kernel vulnerability
UPDATE: Patchlevel update 21.0-p21543 replaces update 21.0-p21536 which provided a workaround for this issue.