Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2023.1133 Cisco NX-OS Software SSH X.509v3 Certificate Authentication with Unsupported Remote Authorization Method Privilege Escalation Issues 23 February 2023 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: NX-OS Software Publisher: Cisco Systems Operating System: Cisco Resolution: Patch/Upgrade Original Bulletin: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-x509v3-unsupportedconfig-ScRtAbUk Comment: CVSS (Max): None available when published - --------------------------BEGIN INCLUDED TEXT-------------------- Cisco NX-OS Software SSH X.509v3 Certificate Authentication with Unsupported Remote Authorization Method Privilege Escalation Issues Priority: Informational Advisory ID: cisco-sa-nxos-x509v3-unsupportedconfig-ScRtAbUk First Published: 2023 February 22 16:00 GMT Version 1.0: Final Workarounds: No workarounds available Cisco Bug IDs: CSCwc17000 CSCwc17198 CSCwc25697 CSCwc25702 CSCwd31232 CSCwd31263 CSCwd34476 CSCwd34477 CSCwe16785 Summary o For certain products that are running Cisco NX-OS Software and are configured for SSH authentication with an X.509 version 3 (X.509v3) certificate, two remote authorization methods are unsupported and could allow for privilege escalation: TACACS+ and certain configurations of Lightweight Directory Access Protocol (LDAP). TACACS+ does not properly validate the distinguished name (DN) of the X.509v3 certificate due to a logic error with authentication, authorization, and accounting (AAA). LDAP does not properly validate the DN of the X.509v3 certificate if the enable cert-dn-match configuration command is not present. The enable cert-dn-match configuration command is required for username validation of the DN of the X.509v3 certificate. Both unsupported configurations could allow a user who is authenticating to the device to elevate their privilege level to Administrator because the DN programmed username on the X.509v3 certificate was not validated and therefore did not have to match the username being authenticated. Cisco has released software updates that address the TACACS+ and LDAP authorization issues, along with updates to the documentation for Cisco NX-OS Software. See Details for information about configuration changes that can address these security issues. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-x509v3-unsupportedconfig-ScRtAbUk Affected Products o Vulnerable Products The following Cisco products are affected if they are running an affected release of Cisco NX-OS Software and they are configured for SSH authentication with X.509v3 certificates and remote authorization using TACACS+: MDS 9000 Series Multilayer Switches ( CSCwd34476 ) Nexus 1000 Virtual Edge for VMware vSphere ( CSCwc25702 ) Nexus 1000V Switch for Microsoft Hyper-V ( CSCwc25702 ) Nexus 1000V Switch for VMware vSphere ( CSCwc25702 ) Nexus 3000 Series Switches ( CSCwc17000 ) Nexus 5500 Platform Switches ( CSCwc25697 ) Nexus 5600 Platform Switches ( CSCwc25697 ) Nexus 6000 Series Switches ( CSCwc25697 ) Nexus 7000 Series Switches ( CSCwc17198 ) Nexus 9000 Series Switches in standalone NX-OS mode ( CSCwc17000 ) For information on how to determine whether a product is using this unsupported configuration, see Determine Whether Unsupported TACACS+ Authorization with SSH X.509v3 Certificates is Configured . The following Cisco products are affected if they are running an affected release of Cisco NX-OS Software and they are configured for SSH authorization with X.509v3 certificates and remote authorization using an unsupported configuration of LDAP: MDS 9000 Series Multilayer Switches ( CSCwd34477 ) Nexus 3000 Series Switches ( CSCwd31232 ) Nexus 7000 Series Switches ( CSCwd31263 ) Nexus 9000 Series Switches in standalone NX-OS mode ( CSCwd31232 ) For information on how to determine whether a product is using this unsupported configuration, see Determine Whether LDAP Authorization with SSH X.509v3 Certificates is Using an Unsupported Configuration . Determine Whether Unsupported TACACS+ Authorization with SSH X.509v3 Certificates is Configured To determine whether a Cisco NX-OS device is configured to use TACACS+ for remote authorization, use the show running-config CLI command. The configuration is unsupported and the device is affected if the following CLI commands are present: aaa authorization ssh-certificate default group groupname where the AAA group is configured for TACACS+ aaa group server tacacs+ groupname The CLI of a device that is running a fixed release of Cisco NX-OS Software would not accept the unsupported configuration. The following example shows the error message that would be returned on a device that is running a fixed release: nxos# config Enter configuration commands, one per line. End with CNTL/Z. nxos(config)# aaa authorization ssh-certificate default group tacacs1 aaa function not supported by configured method could not update aaa configuration When a device is upgraded to a fixed release of Cisco NX-OS Software, any existing aaa authorization ssh-certificate default group groupname commands where the AAA group is configured for TACACS+ are removed from the configuration. Determine Whether LDAP Authorization with SSH X.509v3 Certificates is Using an Unsupported Configuration To determine whether a Cisco NX-OS device is configured to use LDAP for remote authorization, use the show running-config CLI command. The configuration is unsupported and the device is affected if the following conditions are true: The CLI command aaa authorization ssh-certificate default group groupname where the AAA group is configured for LDAP is present. The CLI command aaa group server ldap groupname is configured. The LDAP configuration does not contain enable cert-dn-match . A device is running a supported configuration and is not affected if the CLI command show running-config ldap | include cert-dn-match returns output, as in the following example: nxos# show running-config ldap | include cert-dn-match enable cert-dn-match For MDS 9000 Series and Nexus 7000 Series switches that are running a fixed release of Cisco NX-OS Software, the enable cert-dn-match configuration is enabled by default. Cisco recommends keeping this configuration enabled. For Nexus 3000 Series and 9000 Series switches that are running a fixed release, the enable cert-dn-match logic is always implemented, regardless of whether enable cert-dn-match is present in the configuration. Products Confirmed Not Vulnerable Only products listed in the Vulnerable Products section of this advisory are known to be affected by these issues. Cisco has confirmed that these issues do not affect the following Cisco products: Firepower 1000 Series Firepower 2100 Series Firepower 4100 Series Firepower 9300 Security Appliances Nexus 9000 Series Fabric Switches in ACI mode UCS 6200 Series Fabric Interconnects UCS 6300 Series Fabric Interconnects UCS 6400 Series Fabric Interconnects UCS 6500 Series Fabric Interconnects Details o Cisco recommends the following configuration changes to prevent the security issues that are explained in this advisory: SSH with X.509v3 certificate-based authentication and TACACS+ authorization is unsupported. If the device requires X.509v3 certificate-based authentication, the only valid remote authorization option is LDAP. Use the NX-OS CLI command aaa authorization ssh-certificate default group groupname to reconfigure the AAA group from TACACS+ to LDAP. If NX-OS CLI command aaa authorization ssh-certificate default group groupname is configured and the AAA group is configured for LDAP, add the enable cert-dn-match configuration command. Otherwise, this is an unsupported configuration. Fixed Software o When considering software upgrades , customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page , to determine exposure and a complete upgrade solution. In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers. Fixed Releases The left column lists Cisco NX-OS products. The middle and right columns indicate whether the product is affected by the security issues that are described in this advisory and which releases prevent the issues for the specified remote authorization configuration. Cisco NX-OS Product First Fixed First Fixed Release for Release for LDAP TACACS+ 8.4(2f) (March 8.4(2f) (March MDS 9000 Series Multilayer Switches 2023) 2023) 9.3(2) 9.3(2) Nexus 1000 and 1000V Switches No fixed planned ^ Not applicable 1 Nexus 3000 Series and 9000 Series 9.3(10) 9.3(11) ^2 Switches 10.2(4) 10.2(5) 10.3(1) 10.3(2) Nexus 5500 and 5600 Platform Switches 7.3(12)N1(1) Not applicable and Nexus 6000 Series Switches Nexus 7000 Series Switches 8.2(9) 8.4(7) 8.4(7) 1. All products in the Nexus 1000 product family have reached the End of Software Maintenance milestone in the end-of-life process. See End-of-Sale and End-of-Life Announcement for the Cisco Nexus 1000V Virtual Switch for VMware vSphere for details. 2. Fixed releases of Cisco Nexus 3000 Series and 9000 Series Switches implement the enable cert-dn-match logic regardless of the configuration. This will be changed to be based off the enable cert-dn-match configuration parameter in a future release, which is tracked by CSCwe16785 . The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory. Additional Resources For help determining the best Cisco NX-OS Software release for a Cisco Nexus Switch, see the following Recommended Releases documents. If a security advisory recommends a later release, Cisco recommends following the advisory guidance. Cisco MDS Series Switches Cisco Nexus 1000V for VMware Switch Cisco Nexus 3000 Series Switches Cisco Nexus 5500 Platform Switches Cisco Nexus 5600 Platform Switches Cisco Nexus 6000 Series Switches Cisco Nexus 7000 Series Switches Cisco Nexus 9000 Series Switches Cisco Nexus 9000 Series ACI-Mode Switches To determine the best release for Cisco UCS Software, see the Recommended Releases documents in the release notes for the device. Exploitation and Public Announcements o The Cisco PSIRT is not aware of any public announcements or malicious use of the issues that are described in this advisory. Source o These issues were found during the resolution of a Cisco TAC support case. Cisco Security Vulnerability Policy o To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy . This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco. Subscribe to Cisco Security Notifications o Subscribe Related to This Advisory o URL o https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-x509v3-unsupportedconfig-ScRtAbUk Revision History o +----------+---------------------------+----------+--------+--------------+ | Version | Description | Section | Status | Date | +----------+---------------------------+----------+--------+--------------+ | 1.0 | Initial public release. | - | Final | 2023-FEB-22 | +----------+---------------------------+----------+--------+--------------+ - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: https://auscert.org.au/gpg-key/ iQIVAwUBY/bR48kNZI30y1K9AQjBUA/9HB7IMxRdoFinAuuGQni/ACr57ANrugcd vKk1bFHF++Azm+ilNec2LLLzIcB6oEEqqZVDnPz4oRSbT3E2osc47jwi6Vp9RJH6 jv65M0tsHJ7kfUWBrjEvhQjZSt/tTdkZPvXA6M8dds6Yeg43QF0qx/0+PMuybG2F PhH2rSuOO6cL62eRNlNdY4a9ybRF4O69RZlRCjFEEL3RF8rdJy6/t+EzAl4iFdkZ +Q1UBc/ipkGjIEDqs9Wu8FIWXweAQRiP/uAPXEHiDvJr1ImUkIrJxcV/yymv0zX8 VmknOE9pY+y5IY6n+qa1z/za6lA1QCIu6MZ/q4EXw2fw9ZPLQXYgJSpxfwvdmgdn rY2nUZyaU2+YmRBg0++JopNrM1XucruOstd3EoEbJsdFEqW/bO2ZCa62BEyV91Q2 R+MABZVhkTrCJY1xhcgdlfyw5PXOMc5vftzek6oknoH4QOgreLnTMlRKZ33DSXYJ EURpp5ZTjj50K8OIRM/v0KmfyLKWbTPwsmV+vnqwzu+rjRYtxT8GM5xjbNvCWjD6 ubGzlln6FActWmUkok01DPyfSKJiZiMEDauSsVpUk512vDE7+KzsDDmym53nReUn sdADsofQf76DiY6eo4AEsrcrNkCB8AdEp1yKQxYA0PkvB1N9tPzN98DmfsN6y2Cf /wGUNmgmNrk= =T1Lf -----END PGP SIGNATURE-----