Does Global Protect RADIUS support Message Authentication? (to mitigate BlastRADIUS 9/10 CVSS vulnerability )

[mmason]

Does the Global Protect RADIUS implementation support Messaging Authentication?

If not, how quickly will a hotfix to patch this vulnerable implementation of RADIUS be released?

Background info:

When configuring Global Protect we used RADIUS to integrate RSA Secure ID as a second factor to LDAP, to ensure it took more than just a password to log in, but now it turns out RADIUS was designed to use MD5 hash sums in a way that is inherently insecure as detailed here:  https://www.blastradius.fail/pdf/radius.pdf 

RSA Secure ID released a patch which adds a new value to set in the RADIUS server config files (FreeRadius-Client-require-MA = yes), but the support documentation says the RADIUS client needs to support Messaging Authentication. https://community.securid.com/s/article/RSA-Announces-Critical-Security-Updates-for-RSA-ID-Plus-Comp... 

GlobalProtect Panorama 

[emr_1 · Accepted solution]

Even I'm not sure this is what we are looking at, I found new command on 11.1.3 and above.

I'm not testing anything about it yet and also I'm not researching it on other branches.

"set auth radius-require-msg-authentic yes/no" might be answer for us.

admin@PA-VM> show system info | match sw-version
sw-version: 11.1.1
admin@PA-VM> set auth ?
* strict-username-check   Use strict username check for user role access

admin@PA-VM> 


admin@PA-VM> show system info | match sw-version
sw-version: 11.1.2
admin@PA-VM> set auth ?
* strict-username-check   Use strict username check for user role access

admin@PA-VM> 


admin@PA-VM> show system info | match sw-version
sw-version: 11.1.3
admin@PA-VM> set auth ?
> radius-require-msg-authentic   Flag to check Message-Authenticator in RADIUS response
> remote-host-check              check remote host (client IP address) during auth redirects
> strict-username-check          Use strict username check for user role access

admin@PA-VM> 

[mmason]

That looks promising! Will try it out.

[PavelK · Accepted solution]

Hello @mmason

based on advisory for CVE-2024-3596 the authentication check in RADIUS has been introduced in these versions and newer: PAN-OS 9.1.19, PAN-OS 10.1.14, PAN-OS 10.2.10, PAN-OS 11.0.7, PAN-OS 11.1.3.

Kind Regards

Pavel

[mmason]

Thanks for confirming, waiting for our maintenance window to apply 11.1.3 so we can enable this setting, much appreciated!