KB5040268: How to manage the Access-Request packets attack vulnerability associated with CVE-2024-3596 (2024)

The Access-Request packet was dropped because it contained the Proxy-State attribute but lacked the Message-Authenticator attribute. Consider changing the RADIUS client to include the Message-Authenticator attribute. Or, alternatively, add an exception for the RADIUS client by using the limitProxyState configuration.

This is an audit event for Access-Request packets without the Message-Authenticator attribute in presence of Proxy-State. Consider changing the RADIUS client to include the Message-Authenticator attribute. The RADIUS packet will be dropped once the limitproxystate configuration is enabled.

This is an Audit event for RADIUS response packets received without the Message-Authenticator attribute at the proxy. Consider changing the specified RADIUS server for the Message-Authenticator attribute. The RADIUS packet will be dropped once the requiremsgauth configuration is enabled.

This event is logged during service start when the recommended settings are not configured. Consider enabling the settings if the RADIUS network is unsecure. For secure networks, these events can be ignored.

This configuration enables the NPS Proxy to start sending the Message-Authenticator attribute in all Access-Request packets. To enable this configuration, use one of the following methods.

Method 1: Use the NPS Microsoft Management Console (MMC)

To use the NPS MMC, follow these steps:

1. Open the NPS user interface (UI) on the server.

2. Open the remote Radius Server Groups.

3. Select Radius Server.

4. Go to Authentication/Accounting.

5. Click to select the The request must contain the Message-Authenticator attribute checkbox.

Method 2: Use the netsh command

To use netsh, run the following command:

netsh nps set remoteserver remoteservergroup = <server group name> address = <server address> requireauthattrib = yes

For more information, see Remote RADIUS Server Group Commands.

This configuration requires the Message-Authenticator attribute in all Access-Request messages and drops the packet if absent.

Method 1: Use the NPS Microsoft Management Console (MMC)

To use the NPS MMC, follow these steps:

1. Open the NPS user interface (UI) on the server.

2. Open Radius Clients.

3. Select Radius Client.

4. Go to Advance Settings.

5. Click to select the Access-Request messages must contain the message-authenticator attribute checkbox.

For more information, see Configure RADIUS Clients.

Method 2: Use netsh command

To use netsh, run the following command:

netsh nps set client name = <client name> requireauthattrib = yes

For more information, see Remote RADIUS Server Group Commands.

This configuration enables the NPS server to drop potential vulnerable Access-Request packets that contain a Proxy-State attribute, but do not include a Message-Authenticator attribute. This configuration supports three modes:

• Audit

• Enable

• Disable

In Audit mode, a warning event (Event ID: 4419) is logged, but the request is still processed. Use this mode to identify the non-compliant entities sending the requests.

Use the netsh command to configure, enable, and add an exception as needed.

1. To configure clients in Audit mode, run the following command:

   netsh nps set limitproxystate all = "audit"

2. To configure clients in Enable mode, run the following command:

   netsh nps set limitproxystate all = "enable"

3. To add an exception to exclude a client from limitProxystate validation, run the following command:

   netsh nps set limitproxystate name = <client name> exception = "Yes"

This configuration enables NPS Proxy to drop potentially vulnerable response messages without the Message-Authenticator attribute.This configuration supports three modes:

• Audit

• Enable

• Disable

InAuditmode, a warning event (Event ID: 4420) is logged, but the request is still processed. Use this mode to identify the non-compliant entities sending the responses.

Use thenetshcommand to configure, enable, and add an exception as needed.

1. To configure servers inAuditmode, run the following command:

   netsh nps set requiremsgauthall = "audit"

2. To enable configurations for all servers, run the following command:

   netsh nps set limitproxystate all = "enable"

3. To add an exception to exclude a server fromrequireauthmsgvalidation, run the following command:

   netsh nps set requiremsgauth remoteservergroup = <remote server group name> address = <server address> exception = "yes"

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. We make no warranty, implied or otherwise, about the performance or reliability of these products.

We provide third-party contact information to help you find technical support. This contact information may change without notice. We do not guarantee the accuracy of this third-party contact information.