{"id":7809,"date":"2024-08-17T06:01:14","date_gmt":"2024-08-16T21:01:14","guid":{"rendered":"https:\/\/m365jp.net\/?p=7809"},"modified":"2024-08-17T06:15:57","modified_gmt":"2024-08-16T21:15:57","slug":"mc863964-protect-against-security-risks-and-nps-connection-failures-that-affect-radius-server-environments","status":"publish","type":"post","link":"https:\/\/m365jp.net\/index.php\/2024-08-17-mc863964-protect-against-security-risks-and-nps-connection-failures-that-affect-radius-server-environments","title":{"rendered":"MC863964 | Protect against security risks and NPS connection failures that affect RADIUS server environments"},"content":{"rendered":"
\n
\n
\n\n\n\n
MC863964 | Protect against security risks and NPS connection failures that affect RADIUS server environments<\/th>\n<\/tr>\n<\/tbody>\n<\/table>\n
\n\n\n\n\n\n\n\n\n
Classification<\/th>\nstayInformed<\/td>\n<\/tr>\n
Last Updated<\/th>\n08\/16\/2024 20:21:13<\/td>\n<\/tr>\n
Start Time<\/th>\n08\/16\/2024 20:21:12<\/td>\n<\/tr>\n
End Time<\/th>\n08\/16\/2025 20:21:12<\/td>\n<\/tr>\n
Message Content<\/th>\n\n
A security risk exists in the Remote Authentication Dial-In User Service (RADIUS) protocol. MD5<\/a> collision problems affect User Datagram Protocol<\/a> or UDP-based RADIUS traffic over the internet. Data packets are at risk of forgery or changes to them during transit. To learn more, see KB5040268<\/a>.<\/div>\n
<\/div>\n
As of July 9, 2024, Windows updates support the Message-Authenticator<\/b> attribute in Access-Request<\/b> packets. The new RADIUS standards mandate this change.<\/div>\n
However, if you install the July 2024, or later, updates, Network Policy Server (NPS)<\/a> connection failures can happen. This update does not cause these connection failures. This only occurs if your company\u2019s firewall or RADIUS solution does not support this attribute. To learn more, see KB5043417<\/a>.<\/div>\n
<\/div>\n
We recommend that you enable the Message-Authenticator<\/b> attribute in Access-Request<\/b> packets. Doing this addresses this NPS issue and the security risk.<\/div>\n
 <\/div>\n
When will this happen:<\/b> <\/div>\n
<\/div>\n
As of July 9, 2024, you now have more information to address this NPS issue and security risk in your environment.<\/div>\n
 <\/div>\n
How this will affect your organization:<\/b> <\/div>\n
<\/div>\n
The security risk requires physical access to both the RADIUS network and the NPS. Also, it does not apply when RADIUS traffic goes over a VPN. By making one or more of the changes below, you can enhance the security of UDP-based RADIUS traffic. You can also avoid NPS connection failures.<\/div>\n
<\/div>\n
What you need to do to prepare:<\/b> <\/div>\n
<\/div>\n
To help protect your environment, we recommend that you enable the following:<\/div>\n
<\/div>\n
Machine Translation<\/th>\n\n
Remote Authentication Dial-In User Service (RADIUS) \u30d7\u30ed\u30c8\u30b3\u30eb\u306b\u306f\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4e0a\u306e\u30ea\u30b9\u30af\u304c\u3042\u308a\u307e\u3059\u3002 MD5<\/a> \u30b3\u30ea\u30b8\u30e7\u30f3\u306e\u554f\u984c\u306f\u3001\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u4e0a\u306e \u30e6\u30fc\u30b6\u30fc \u30c7\u30fc\u30bf\u30b0\u30e9\u30e0 \u30d7\u30ed\u30c8\u30b3\u30eb<\/a> \u307e\u305f\u306f UDP \u30d9\u30fc\u30b9\u306e RADIUS \u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306b\u5f71\u97ff\u3057\u307e\u3059\u3002\u30c7\u30fc\u30bf\u30d1\u30b1\u30c3\u30c8\u306f\u3001\u8ee2\u9001\u4e2d\u306b\u507d\u9020\u307e\u305f\u306f\u5909\u66f4\u3055\u308c\u308b\u30ea\u30b9\u30af\u304c\u3042\u308a\u307e\u3059\u3002\u8a73\u7d30\u306b\u3064\u3044\u3066\u306f\u3001\u300c KB5040268<\/a>\u300d\u3092\u53c2\u7167\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/div>\n
<\/div>\n
2024 \u5e74 7 \u6708 9 \u65e5\u306e\u6642\u70b9\u3067\u3001Windows \u66f4\u65b0\u30d7\u30ed\u30b0\u30e9\u30e0\u3067\u306f Access-Request<\/b> \u30d1\u30b1\u30c3\u30c8\u306e Message-Authenticator<\/b> \u5c5e\u6027\u304c\u30b5\u30dd\u30fc\u30c8\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u65b0\u3057\u3044 RADIUS \u6a19\u6e96\u3067\u306f\u3001\u3053\u306e\u5909\u66f4\u304c\u7fa9\u52d9\u4ed8\u3051\u3089\u308c\u3066\u3044\u307e\u3059\u3002<\/div>\n
\u305f\u3060\u3057\u30012024 \u5e74 7 \u6708\u4ee5\u964d\u306e\u66f4\u65b0\u30d7\u30ed\u30b0\u30e9\u30e0\u3092\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3059\u308b\u3068\u3001 \u30cd\u30c3\u30c8\u30ef\u30fc\u30af \u30dd\u30ea\u30b7\u30fc \u30b5\u30fc\u30d0\u30fc (NPS)<\/a> \u63a5\u7d9a\u30a8\u30e9\u30fc\u304c\u767a\u751f\u3059\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u3053\u306e\u66f4\u65b0\u30d7\u30ed\u30b0\u30e9\u30e0\u3067\u306f\u3001\u3053\u308c\u3089\u306e\u63a5\u7d9a\u30a8\u30e9\u30fc\u306f\u767a\u751f\u3057\u307e\u305b\u3093\u3002\u3053\u308c\u306f\u3001\u4f1a\u793e\u306e\u30d5\u30a1\u30a4\u30a2\u30a6\u30a9\u30fc\u30eb\u307e\u305f\u306f RADIUS \u30bd\u30ea\u30e5\u30fc\u30b7\u30e7\u30f3\u304c\u3053\u306e\u5c5e\u6027\u3092\u30b5\u30dd\u30fc\u30c8\u3057\u3066\u3044\u306a\u3044\u5834\u5408\u306b\u306e\u307f\u767a\u751f\u3057\u307e\u3059\u3002\u8a73\u7d30\u306b\u3064\u3044\u3066\u306f\u3001\u300c KB5043417<\/a>\u300d\u3092\u53c2\u7167\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/div>\n
<\/div>\n
Access-Request<\/b> \u30d1\u30b1\u30c3\u30c8\u3067 Message-Authenticator<\/b> \u5c5e\u6027\u3092\u6709\u52b9\u306b\u3059\u308b\u3053\u3068\u3092\u304a\u52e7\u3081\u3057\u307e\u3059\u3002\u3053\u308c\u306b\u3088\u308a\u3001\u3053\u306eNPS\u306e\u554f\u984c\u3068\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ea\u30b9\u30af\u304c\u89e3\u6d88\u3055\u308c\u307e\u3059\u3002<\/div>\n
 <\/div>\n
\u3053\u308c\u306f\u3044\u3064\u884c\u308f\u308c\u307e\u3059\u304b:<\/b> <\/div>\n
<\/div>\n
2024 \u5e74 7 \u6708 9 \u65e5\u306e\u6642\u70b9\u3067\u3001\u3053\u306e NPS \u306e\u554f\u984c\u3068\u74b0\u5883\u5185\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30ea\u30b9\u30af\u306b\u5bfe\u51e6\u3059\u308b\u305f\u3081\u306e\u3088\u308a\u591a\u304f\u306e\u60c5\u5831\u304c\u5f97\u3089\u308c\u307e\u3057\u305f\u3002<\/div>\n
 <\/div>\n
\u3053\u308c\u304c\u7d44\u7e54\u306b\u4e0e\u3048\u308b\u5f71\u97ff:<\/b> <\/div>\n
<\/div>\n
\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 \u30ea\u30b9\u30af\u306b\u306f\u3001RADIUS \u30cd\u30c3\u30c8\u30ef\u30fc\u30af\u3068 NPS \u306e\u4e21\u65b9\u3078\u306e\u7269\u7406\u7684\u306a\u30a2\u30af\u30bb\u30b9\u304c\u5fc5\u8981\u3067\u3059\u3002\u307e\u305f\u3001RADIUS \u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u304c VPN \u3092\u7d4c\u7531\u3059\u308b\u5834\u5408\u3082\u9069\u7528\u3055\u308c\u307e\u305b\u3093\u3002\u4ee5\u4e0b\u306e 1 \u3064\u4ee5\u4e0a\u306e\u5909\u66f4\u3092\u884c\u3046\u3053\u3068\u3067\u3001UDP \u30d9\u30fc\u30b9\u306e RADIUS \u30c8\u30e9\u30d5\u30a3\u30c3\u30af\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u3092\u5f37\u5316\u3067\u304d\u307e\u3059\u3002\u307e\u305f\u3001NPS \u63a5\u7d9a\u306e\u5931\u6557\u3092\u56de\u907f\u3059\u308b\u3053\u3068\u3082\u3067\u304d\u307e\u3059\u3002<\/div>\n
<\/div>\n
\u6e96\u5099\u3059\u308b\u305f\u3081\u306b\u5fc5\u8981\u306a\u3053\u3068:<\/b> <\/div>\n
<\/div>\n
\u74b0\u5883\u3092\u4fdd\u8b77\u3059\u308b\u305f\u3081\u306b\u3001\u4ee5\u4e0b\u3092\u6709\u52b9\u306b\u3059\u308b\u3053\u3068\u3092\u304a\u52e7\u3081\u3057\u307e\u3059\u3002<\/div>\n
<\/div>\n