-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2023.1133
     Cisco NX-OS Software SSH X.509v3 Certificate Authentication with
    Unsupported Remote Authorization Method Privilege Escalation Issues
                             23 February 2023

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           NX-OS Software
Publisher:         Cisco Systems
Operating System:  Cisco
Resolution:        Patch/Upgrade

Original Bulletin: 
   https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-x509v3-unsupportedconfig-ScRtAbUk

Comment: CVSS (Max):  None available when published

- --------------------------BEGIN INCLUDED TEXT--------------------

Cisco NX-OS Software SSH X.509v3 Certificate Authentication with Unsupported
Remote Authorization Method Privilege Escalation Issues

Priority:        Informational
Advisory ID:     cisco-sa-nxos-x509v3-unsupportedconfig-ScRtAbUk
First Published: 2023 February 22 16:00 GMT
Version 1.0:     Final
Workarounds:     No workarounds available
Cisco Bug IDs:   CSCwc17000 CSCwc17198 CSCwc25697 CSCwc25702 CSCwd31232
                 CSCwd31263 CSCwd34476 CSCwd34477 CSCwe16785

Summary

  o For certain products that are running Cisco NX-OS Software and are
    configured for SSH authentication with an X.509 version 3 (X.509v3)
    certificate, two remote authorization methods are unsupported and could
    allow for privilege escalation: TACACS+ and certain configurations of
    Lightweight Directory Access Protocol (LDAP).

       TACACS+ does not properly validate the distinguished name (DN) of the
        X.509v3 certificate due to a logic error with authentication,
        authorization, and accounting (AAA).
       LDAP does not properly validate the DN of the X.509v3 certificate if
        the enable cert-dn-match configuration command is not present. The
        enable cert-dn-match configuration command is required for username
        validation of the DN of the X.509v3 certificate.

    Both unsupported configurations could allow a user who is authenticating to
    the device to elevate their privilege level to Administrator because the DN
    programmed username on the X.509v3 certificate was not validated and
    therefore did not have to match the username being authenticated.

    Cisco has released software updates that address the TACACS+ and LDAP
    authorization issues, along with updates to the documentation for Cisco
    NX-OS Software. See Details for information about configuration changes
    that can address these security issues.

    This advisory is available at the following link:
    https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-x509v3-unsupportedconfig-ScRtAbUk

Affected Products

  o Vulnerable Products

    The following Cisco products are affected if they are running an affected
    release of Cisco NX-OS Software and they are configured for SSH
    authentication with X.509v3 certificates and remote authorization using
    TACACS+:

       MDS 9000 Series Multilayer Switches ( CSCwd34476 )
       Nexus 1000 Virtual Edge for VMware vSphere ( CSCwc25702 )
       Nexus 1000V Switch for Microsoft Hyper-V ( CSCwc25702 )
       Nexus 1000V Switch for VMware vSphere ( CSCwc25702 )
       Nexus 3000 Series Switches ( CSCwc17000 )
       Nexus 5500 Platform Switches ( CSCwc25697 )
       Nexus 5600 Platform Switches ( CSCwc25697 )
       Nexus 6000 Series Switches ( CSCwc25697 )
       Nexus 7000 Series Switches ( CSCwc17198 )
       Nexus 9000 Series Switches in standalone NX-OS mode ( CSCwc17000 )

    For information on how to determine whether a product is using this
    unsupported configuration, see Determine Whether Unsupported TACACS+
    Authorization with SSH X.509v3 Certificates is Configured .

    The following Cisco products are affected if they are running an affected
    release of Cisco NX-OS Software and they are configured for SSH
    authorization with X.509v3 certificates and remote authorization using an
    unsupported configuration of LDAP:

       MDS 9000 Series Multilayer Switches ( CSCwd34477 )
       Nexus 3000 Series Switches ( CSCwd31232 )
       Nexus 7000 Series Switches ( CSCwd31263 )
       Nexus 9000 Series Switches in standalone NX-OS mode ( CSCwd31232 )

    For information on how to determine whether a product is using this
    unsupported configuration, see Determine Whether LDAP Authorization with
    SSH X.509v3 Certificates is Using an Unsupported Configuration .

    Determine Whether Unsupported TACACS+ Authorization with SSH X.509v3
    Certificates is Configured

    To determine whether a Cisco NX-OS device is configured to use TACACS+ for
    remote authorization, use the show running-config CLI command. The
    configuration is unsupported and the device is affected if the following
    CLI commands are present:

       aaa authorization ssh-certificate default group groupname where the AAA
        group is configured for TACACS+
       aaa group server tacacs+ groupname

    The CLI of a device that is running a fixed release of Cisco NX-OS Software
    would not accept the unsupported configuration. The following example shows
    the error message that would be returned on a device that is running a
    fixed release:

        nxos# config
        Enter configuration commands, one per line.  End with CNTL/Z.
        nxos(config)# aaa authorization ssh-certificate default group tacacs1
        aaa function not supported by configured method
        could not update aaa configuration

    When a device is upgraded to a fixed release of Cisco NX-OS Software, any
    existing aaa authorization ssh-certificate default group groupname commands
    where the AAA group is configured for TACACS+ are removed from the
    configuration.

    Determine Whether LDAP Authorization with SSH X.509v3 Certificates is Using
    an Unsupported Configuration

    To determine whether a Cisco NX-OS device is configured to use LDAP for
    remote authorization, use the show running-config CLI command. The
    configuration is unsupported and the device is affected if the following
    conditions are true:

       The CLI command aaa authorization ssh-certificate default group 
        groupname where the AAA group is configured for LDAP is present.
       The CLI command aaa group server ldap groupname is configured.
       The LDAP configuration does not contain enable cert-dn-match .

    A device is running a supported configuration and is not affected if the
    CLI command show running-config ldap | include cert-dn-match returns
    output, as in the following example:

        nxos# show running-config ldap | include cert-dn-match
        enable cert-dn-match

    For MDS 9000 Series and Nexus 7000 Series switches that are running a fixed
    release of Cisco NX-OS Software, the enable cert-dn-match configuration is
    enabled by default. Cisco recommends keeping this configuration enabled.
    For Nexus 3000 Series and 9000 Series switches that are running a fixed
    release, the enable cert-dn-match logic is always implemented, regardless
    of whether enable cert-dn-match is present in the configuration.

    Products Confirmed Not Vulnerable

    Only products listed in the Vulnerable Products section of this advisory
    are known to be affected by these issues.

    Cisco has confirmed that these issues do not affect the following Cisco
    products:

       Firepower 1000 Series
       Firepower 2100 Series
       Firepower 4100 Series
       Firepower 9300 Security Appliances
       Nexus 9000 Series Fabric Switches in ACI mode
       UCS 6200 Series Fabric Interconnects
       UCS 6300 Series Fabric Interconnects
       UCS 6400 Series Fabric Interconnects
       UCS 6500 Series Fabric Interconnects

Details

  o Cisco recommends the following configuration changes to prevent the
    security issues that are explained in this advisory:

       SSH with X.509v3 certificate-based authentication and TACACS+
        authorization is unsupported. If the device requires X.509v3
        certificate-based authentication, the only valid remote authorization
        option is LDAP. Use the NX-OS CLI command aaa authorization
        ssh-certificate default group groupname to reconfigure the AAA group
        from TACACS+ to LDAP.
       If NX-OS CLI command aaa authorization ssh-certificate default group 
        groupname is configured and the AAA group is configured for LDAP, add
        the enable cert-dn-match configuration command. Otherwise, this is an
        unsupported configuration.

Fixed Software

  o When considering software upgrades , customers are advised to regularly
    consult the advisories for Cisco products, which are available from the
    Cisco Security Advisories page , to determine exposure and a complete
    upgrade solution.

    In all cases, customers should ensure that the devices to be upgraded
    contain sufficient memory and confirm that current hardware and software
    configurations will continue to be supported properly by the new release.
    If the information is not clear, customers are advised to contact the Cisco
    Technical Assistance Center (TAC) or their contracted maintenance
    providers.

    Fixed Releases

    The left column lists Cisco NX-OS products. The middle and right columns
    indicate whether the product is affected by the security issues that are
    described in this advisory and which releases prevent the issues for the
    specified remote authorization configuration.

    Cisco NX-OS Product                     First Fixed        First Fixed
                                            Release for        Release for LDAP
                                            TACACS+
                                            8.4(2f) (March     8.4(2f) (March
    MDS 9000 Series Multilayer Switches     2023)              2023)
                                            9.3(2)             9.3(2)
    Nexus 1000 and 1000V Switches           No fixed planned ^ Not applicable
                                            1
    Nexus 3000 Series and 9000 Series       9.3(10)            9.3(11) ^2
    Switches                                10.2(4)            10.2(5)
                                            10.3(1)            10.3(2)
    Nexus 5500 and 5600 Platform Switches   7.3(12)N1(1)       Not applicable
    and Nexus 6000 Series Switches
    Nexus 7000 Series Switches              8.2(9)             8.4(7)
                                            8.4(7)

    1. All products in the Nexus 1000 product family have reached the End of
    Software Maintenance milestone in the end-of-life process. See End-of-Sale
    and End-of-Life Announcement for the Cisco Nexus 1000V Virtual Switch for
    VMware vSphere for details.
    2. Fixed releases of Cisco Nexus 3000 Series and 9000 Series Switches
    implement the enable cert-dn-match logic regardless of the configuration.
    This will be changed to be based off the enable cert-dn-match configuration
    parameter in a future release, which is tracked by CSCwe16785 .

    The Cisco Product Security Incident Response Team (PSIRT) validates only
    the affected and fixed release information that is documented in this
    advisory.

    Additional Resources

    For help determining the best Cisco NX-OS Software release for a Cisco
    Nexus Switch, see the following Recommended Releases documents. If a
    security advisory recommends a later release, Cisco recommends following
    the advisory guidance.

        Cisco MDS Series Switches
        Cisco Nexus 1000V for VMware Switch
        Cisco Nexus 3000 Series Switches
        Cisco Nexus 5500 Platform Switches
        Cisco Nexus 5600 Platform Switches
        Cisco Nexus 6000 Series Switches
        Cisco Nexus 7000 Series Switches
        Cisco Nexus 9000 Series Switches
        Cisco Nexus 9000 Series ACI-Mode Switches

    To determine the best release for Cisco UCS Software, see the Recommended
    Releases documents in the release notes for the device.

Exploitation and Public Announcements

  o The Cisco PSIRT is not aware of any public announcements or malicious use
    of the issues that are described in this advisory.

Source

  o These issues were found during the resolution of a Cisco TAC support case.

Cisco Security Vulnerability Policy

  o To learn about Cisco security vulnerability disclosure policies and
    publications, see the Security Vulnerability Policy . This document also
    contains instructions for obtaining fixed software and receiving security
    vulnerability information from Cisco.

Subscribe to Cisco Security Notifications

  o Subscribe

Related to This Advisory

  o 

URL

  o https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-x509v3-unsupportedconfig-ScRtAbUk

Revision History

  o +----------+---------------------------+----------+--------+--------------+
    | Version  |        Description        | Section  | Status |     Date     |
    +----------+---------------------------+----------+--------+--------------+
    | 1.0      | Initial public release.   | -        | Final  | 2023-FEB-22  |
    +----------+---------------------------+----------+--------+--------------+

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/

iQIVAwUBY/bR48kNZI30y1K9AQjBUA/9HB7IMxRdoFinAuuGQni/ACr57ANrugcd
vKk1bFHF++Azm+ilNec2LLLzIcB6oEEqqZVDnPz4oRSbT3E2osc47jwi6Vp9RJH6
jv65M0tsHJ7kfUWBrjEvhQjZSt/tTdkZPvXA6M8dds6Yeg43QF0qx/0+PMuybG2F
PhH2rSuOO6cL62eRNlNdY4a9ybRF4O69RZlRCjFEEL3RF8rdJy6/t+EzAl4iFdkZ
+Q1UBc/ipkGjIEDqs9Wu8FIWXweAQRiP/uAPXEHiDvJr1ImUkIrJxcV/yymv0zX8
VmknOE9pY+y5IY6n+qa1z/za6lA1QCIu6MZ/q4EXw2fw9ZPLQXYgJSpxfwvdmgdn
rY2nUZyaU2+YmRBg0++JopNrM1XucruOstd3EoEbJsdFEqW/bO2ZCa62BEyV91Q2
R+MABZVhkTrCJY1xhcgdlfyw5PXOMc5vftzek6oknoH4QOgreLnTMlRKZ33DSXYJ
EURpp5ZTjj50K8OIRM/v0KmfyLKWbTPwsmV+vnqwzu+rjRYtxT8GM5xjbNvCWjD6
ubGzlln6FActWmUkok01DPyfSKJiZiMEDauSsVpUk512vDE7+KzsDDmym53nReUn
sdADsofQf76DiY6eo4AEsrcrNkCB8AdEp1yKQxYA0PkvB1N9tPzN98DmfsN6y2Cf
/wGUNmgmNrk=
=T1Lf
-----END PGP SIGNATURE-----