topic Does Global Protect RADIUS support Message Authentication? (to mitigate BlastRADIUS 9/10 CVSS vulnerability ) in GlobalProtect Discussions

Does Global Protect RADIUS support Message Authentication? (to mitigate BlastRADIUS 9/10 CVSS vulnerability )

mmason — Tue, 09 Jul 2024 22:24:30 GMT

Does the Global Protect RADIUS implementation support Messaging Authentication?

If not, how quickly will a hotfix to patch this vulnerable implementation of RADIUS be released?

Background info:

When configuring Global Protect we used RADIUS to integrate RSA Secure ID as a second factor to LDAP, to ensure it took more than just a password to log in, but now it turns out RADIUS was designed to use MD5 hash sums in a way that is inherently insecure as detailed here: https://www.blastradius.fail/pdf/radius.pdf

RSA Secure ID released a patch which adds a new value to set in the RADIUS server config files (FreeRadius-Client-require-MA = yes), but the support documentation says the RADIUS client needs to support Messaging Authentication. https://community.securid.com/s/article/RSA-Announces-Critical-Security-Updates-for-RSA-ID-Plus-Components-RSA-Authentication-Manager-and-RSA-Identity-Router

Re: Does Global Protect RADIUS support Message Authentication? (to mitigate BlastRADIUS 9/10 CVSS vulnerability )

emr_1 — Wed, 10 Jul 2024 01:59:51 GMT

Even I'm not sure this is what we are looking at, I found new command on 11.1.3 and above.

I'm not testing anything about it yet and also I'm not researching it on other branches.

"set auth radius-require-msg-authentic yes/no" might be answer for us.

admin@PA-VM> show system info | match sw-version sw-version: 11.1.1 admin@PA-VM> set auth ? * strict-username-check Use strict username check for user role access admin@PA-VM> admin@PA-VM> show system info | match sw-version sw-version: 11.1.2 admin@PA-VM> set auth ? * strict-username-check Use strict username check for user role access admin@PA-VM> admin@PA-VM> show system info | match sw-version sw-version: 11.1.3 admin@PA-VM> set auth ? > radius-require-msg-authentic Flag to check Message-Authenticator in RADIUS response > remote-host-check check remote host (client IP address) during auth redirects > strict-username-check Use strict username check for user role access admin@PA-VM>

Re: Does Global Protect RADIUS support Message Authentication? (to mitigate BlastRADIUS 9/10 CVSS vulnerability )

mmason — Wed, 10 Jul 2024 16:14:38 GMT

That looks promising! Will try it out.

Re: Does Global Protect RADIUS support Message Authentication? (to mitigate BlastRADIUS 9/10 CVSS vulnerability )

PavelK — Wed, 10 Jul 2024 22:40:51 GMT

Hello @mmason

based on advisory for CVE-2024-3596 the authentication check in RADIUS has been introduced in these versions and newer: PAN-OS 9.1.19, PAN-OS 10.1.14, PAN-OS 10.2.10, PAN-OS 11.0.7, PAN-OS 11.1.3.

Kind Regards

Pavel

Re: Does Global Protect RADIUS support Message Authentication? (to mitigate BlastRADIUS 9/10 CVSS vulnerability )

mmason — Wed, 10 Jul 2024 22:43:31 GMT

Thanks for confirming, waiting for our maintenance window to apply 11.1.3 so we can enable this setting, much appreciated!

Re: Does Global Protect RADIUS support Message Authentication? (to mitigate BlastRADIUS 9/10 CVSS vulnerability )

NetworkEnginear — Wed, 14 Aug 2024 23:55:39 GMT

I ran this command on a PA-5430 with 11.1.3-h4 installed. I set it to yes to require message authentication and ran the show command to see if it was accepted but I got no output. As a result, the connection to my RADIUS server is still broken until I find a workaround.

Re: Does Global Protect RADIUS support Message Authentication? (to mitigate BlastRADIUS 9/10 CVSS vulnerability )

Chris_Johnston — Tue, 10 Sep 2024 13:40:02 GMT

re: no output: Same experience on 10.2.10-h1 and 11.2.0

On the API, when set to yes or no, response is the same. Missing CDATA. I'll be opening a ticket with PA to check on this today.

<show><auth><radius-require-msg-authentic></radius-require-msg-authentic></auth></show>

<![CDATA[ ]]>

</result>

</response>
-------------------------------------------
Edit/Add: PA noted it the lack of display is a bug. Can be gathered through one of the three methods currently

Verified the sdb variable is set to True from TSF at location <tsffile>\tmp\cli\logs\sdb.txt
cfg.auth.radius-require-msg-authentic: True

you can verify the same from CLI using the command
> show system state | match cfg.auth.radius-require-msg-authentic

API command below:
https://<firewall>/api/?type=op&cmd=<show><system><state><filter>cfg.auth.radius-require-msg-authent...