RADIUS vulnerability

Fortinet has resolved a RADIUS vulnerability as described in CVE-2024-3596. As a result, firewall authentication, FortiGate administrative web UI authentication, and WiFi authentication may be affected depending on the functionality of the RADIUS server software used in your environment. RFC 3579 contains information on the affected RADIUS attribute, message-authenticator.

In order to protect against the RADIUS vulnerability described in CVE-2024-3596, as a RADIUS client, FortiGate will:

1. Force the validation of message-authenticator.

2. Reject RADIUS responses with unrecognized proxy-state attribute.

Message-authenticator checking is made mandatory under UDP/TCP. It is not mandatory when using TLS. Users are highly encouraged to use RADSEC with the RADIUS server configuration, which is supported starting in version 7.4.0. For more information, see Configuring a RADSEC client.

If FortiGate is using UDP/TCP mode without RADSEC, the RADIUS server should be patched to ensure the message-authenticator attribute is used in its RADIUS messages.

Affected Product Integration

• FortiAuthenticator version 6.6.1 and older.

• Third party RADIUS server that does not support sending the message-authenticator attribute.

Solution

• Upgrade FortiAuthenticator to version 6.4.10, 6.5.6, or 6.6.2 and follow the Upgrade instructions.

• Upgrade the RADIUS server and/or enable it to send the correct message-authenticator attribute.