[Issues] [mod_auth_xradius 0000165]: Replay Attack possible xradius with apr_memcache

[Mantis Bug Tracker]

The following issue has been SUBMITTED. 
====================================================================== 
http://issues.outoforder.cc/view.php?id=165 
====================================================================== 
Reported By:                pcfreak
Assigned To:                
====================================================================== 
Project:                    mod_auth_xradius
Issue ID:                   165
Category:                   Security Issue
Reproducibility:            always
Severity:                   major
Priority:                   high
Status:                     new
Apache Version:             apache2 Version: 2.2.16-6+squeeze3 
====================================================================== 
Date Submitted:             2011-09-29 06:27 EDT
Last Modified:              2011-09-29 06:27 EDT
====================================================================== 
Summary:                    Replay Attack possible xradius with apr_memcache
Description: 
On Debian Squeeze I successfully compiled mod_auth_xradius and apr_memcache. I
authenticate against a radius server backend that verifies SafeWord OTP Tokens.
Everything looks good so far, but when I sniff the "Authorization: Basic" string
in http traffic and base64decode it I can use the credentials on different
sessions and on different IPs.

A so called replay attack is possible during the "AuthXRadiusCacheTimeout" even
from a different IP.

I don't know if this is related to xradius or apr_memcache.

Steps to Reproduce: 
Use tcpflow to sniff http-session and grab the 

Authorization: Basic d0Y5NjMzMzc6MTExMjkzMjA5NzAw

string. Do a 
  "echo d0Y5NjMzMzc6MTExMjg3NTAyOTIz | base64 -d - && echo"

and then you have

  wF963337:111287502923

During the AuthXRadiusCacheTimeout you can use the credentials

 U: wF963337
 P: 111287502923

on any machine to authenticate.

Additional Information: 
Relevant parts of apache site config

<IfModule auth_xradius_module>
  ##The Cache for mod_auth_xradius must be configured globally.
  ##If you do not want Authentication Caching, set:
  AuthXRadiusCache memcache "127.0.0.1:11211"
  ## Time in Seconds that an entry will be cached.
  AuthXRadiusCacheTimeout 300
</IfModule>

<IfModule auth_xradius_module>
 <Location "/">
    ## Type of authentication to use - radius needs basic
    AuthType Basic
    ## We have to assign xradius as provider here
    AuthBasicProvider xradius
    ## Client prompt for authentication
    AuthName "Credentials needed"
    ## Address and the Shared Secret of the RADIUS Server(s) to contact.
    AuthXRadiusAddServer "10.11.12.13:1812" "yoursecret"
    #AuthXRadiusAddServer "10.11.12.14:1812" "yoursecret"
    ## Time in Seconds to wait for replies from the RADIUS Servers
    AuthXRadiusTimeout 7
    ## Number of times to resend a request to a server if no reply is received.
    AuthXRadiusRetries 2
    ## This tells apache that we want a valid user and password.
    require valid-user
 </Location>
</IfModule>

Version of memcached
Package: memcached Version: 1.4.5-1


====================================================================== 

Issue History 
Date Modified    Username       Field                    Change               
====================================================================== 
2011-09-29 06:27 pcfreak        New Issue                                    
======================================================================