Network Policy Server Denial of Service Vulnerability

This is a denial of service vulnerability. An unauthenticated attacker who successfully exploited this vulnerability could send specially crafted username strings to an Internet Authentication Service (IAS) or Network Policy Server (NPS), causing a denial of service condition for RADIUS authentication on the IAS or NPS. Note that the denial of service vulnerability would not allow an attacker to execute code or to elevate user rights; however, it could prevent RADIUS authentication on the IAS or NPS. An attacker who successfully exploited the vulnerability could cause the target system to stop responding. Network Policy Servers that allow remote, untrusted users to authenticate are at particular risk from this vulnerability. The update addresses the denial of service vulnerability by changing how Network Policy Servers parse username queries when implementing RADIUS.