Microsoft NPS RADIUS DoS

February 19, 2016

Remote Authentication Dial In User Service (RADIUS), a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) services to connect network resources. Attacker can use crafted username which could lead to Denial of Service.

To Authenticate and Authorize users, RADIUS server connects to Domain controller. Active Directory is queried for username upon incoming access request message. This involves establishing LDAP connection and passing LDAP query. LDAP filter tests the username for predefined special characters and normalize them except NUL character. If username string starts with NUL character it causes Active Directory Domain Controller server to return an error value. Multiple invalid requests cause RADIUS server to disassociated from Active Directory Domain controller. Causing Denial of further requests.

Dell SonicWALL has released IPS signatures to detect and block exploitation attempts targeting this vulnerability. The signatures are listed below:

  • 11458 Microsoft Network Policy Server RADIUS DoS
  • 11459 Microsoft Network Policy Server RADIUS DoS 1