Home / Cisco Security / Security Advisories

Cisco Security Advisory

Cisco NX-OS Software SSH X.509v3 Certificate Authentication with Unsupported Remote Authorization Method Privilege Escalation Issues

Informational
Advisory ID:
cisco-sa-nxos-x509v3-unsupportedconfig-ScRtAbUk
First Published:
2023 February 22 16:00 GMT
Version 1.0:
Final
Workarounds:
No workarounds available

Summary

  • For certain products that are running Cisco NX-OS Software and are configured for SSH authentication with an X.509 version 3 (X.509v3) certificate, two remote authorization methods are unsupported and could allow for privilege escalation: TACACS+ and certain configurations of Lightweight Directory Access Protocol (LDAP).

    • TACACS+ does not properly validate the distinguished name (DN) of the X.509v3 certificate due to a logic error with authentication, authorization, and accounting (AAA).
    • LDAP does not properly validate the DN of the X.509v3 certificate if the enable cert-dn-match configuration command is not present. The enable cert-dn-match configuration command is required for username validation of the DN of the X.509v3 certificate.

    Both unsupported configurations could allow a user who is authenticating to the device to elevate their privilege level to Administrator because the DN programmed username on the X.509v3 certificate was not validated and therefore did not have to match the username being authenticated.

    Cisco has released software updates that address the TACACS+ and LDAP authorization issues, along with updates to the documentation for Cisco NX-OS Software. See Details for information about configuration changes that can address these security issues.

    This advisory is available at the following link:
    https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-nxos-x509v3-unsupportedconfig-ScRtAbUk

Affected Products

  • Vulnerable Products

    The following Cisco products are affected if they are running an affected release of Cisco NX-OS Software and they are configured for SSH authentication with X.509v3 certificates and remote authorization using TACACS+:

    For information on how to determine whether a product is using this unsupported configuration, see Determine Whether Unsupported TACACS+ Authorization with SSH X.509v3 Certificates is Configured.

    The following Cisco products are affected if they are running an affected release of Cisco NX-OS Software and they are configured for SSH authorization with X.509v3 certificates and remote authorization using an unsupported configuration of LDAP:

    For information on how to determine whether a product is using this unsupported configuration, see Determine Whether LDAP Authorization with SSH X.509v3 Certificates is Using an Unsupported Configuration.

    Determine Whether Unsupported TACACS+ Authorization with SSH X.509v3 Certificates is Configured

    To determine whether a Cisco NX-OS device is configured to use TACACS+ for remote authorization, use the show running-config CLI command. The configuration is unsupported and the device is affected if the following CLI commands are present:

    • aaa authorization ssh-certificate default group groupname where the AAA group is configured for TACACS+
    • aaa group server tacacs+ groupname

    The CLI of a device that is running a fixed release of Cisco NX-OS Software would not accept the unsupported configuration. The following example shows the error message that would be returned on a device that is running a fixed release:

    nxos# config
    Enter configuration commands, one per line.  End with CNTL/Z.
    nxos(config)# aaa authorization ssh-certificate default group tacacs1
    aaa function not supported by configured method
    could not update aaa configuration

    When a device is upgraded to a fixed release of Cisco NX-OS Software, any existing aaa authorization ssh-certificate default group groupname commands where the AAA group is configured for TACACS+ are removed from the configuration.

    Determine Whether LDAP Authorization with SSH X.509v3 Certificates is Using an Unsupported Configuration

    To determine whether a Cisco NX-OS device is configured to use LDAP for remote authorization, use the show running-config CLI command. The configuration is unsupported and the device is affected if the following conditions are true:

    • The CLI command aaa authorization ssh-certificate default group groupname where the AAA group is configured for LDAP is present.
    • The CLI command aaa group server ldap groupname is configured.
    • The LDAP configuration does not contain enable cert-dn-match.

    A device is running a supported configuration and is not affected if the CLI command show running-config ldap | include cert-dn-match returns output, as in the following example:

    nxos# show running-config ldap | include cert-dn-match
    enable cert-dn-match

    For MDS 9000 Series and Nexus 7000 Series switches that are running a fixed release of Cisco NX-OS Software, the enable cert-dn-match configuration is enabled by default. Cisco recommends keeping this configuration enabled. For Nexus 3000 Series and 9000 Series switches that are running a fixed release, the enable cert-dn-match logic is always implemented, regardless of whether enable cert-dn-match is present in the configuration.

    Products Confirmed Not Vulnerable

    Only products listed in the Vulnerable Products section of this advisory are known to be affected by these issues.

    Cisco has confirmed that these issues do not affect the following Cisco products:

    • Firepower 1000 Series
    • Firepower 2100 Series
    • Firepower 4100 Series
    • Firepower 9300 Security Appliances
    • Nexus 9000 Series Fabric Switches in ACI mode
    • UCS 6200 Series Fabric Interconnects
    • UCS 6300 Series Fabric Interconnects
    • UCS 6400 Series Fabric Interconnects
    • UCS 6500 Series Fabric Interconnects

Details

  • Cisco recommends the following configuration changes to prevent the security issues that are explained in this advisory:

    • SSH with X.509v3 certificate-based authentication and TACACS+ authorization is unsupported. If the device requires X.509v3 certificate-based authentication, the only valid remote authorization option is LDAP. Use the NX-OS CLI command aaa authorization ssh-certificate default group groupname to reconfigure the AAA group from TACACS+ to LDAP.
    • If NX-OS CLI command aaa authorization ssh-certificate default group groupname is configured and the AAA group is configured for LDAP, add the enable cert-dn-match configuration command. Otherwise, this is an unsupported configuration.

Fixed Software

  • When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure and a complete upgrade solution.

    In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.

    Fixed Releases

    The left column lists Cisco NX-OS products. The middle and right columns indicate whether the product is affected by the security issues that are described in this advisory and which releases prevent the issues for the specified remote authorization configuration.

    Cisco NX-OS Product First Fixed Release for TACACS+ First Fixed Release for LDAP
    MDS 9000 Series Multilayer Switches 8.4(2f) (March 2023)
    9.3(2)    		 8.4(2f) (March 2023)
    9.3(2)
    Nexus 1000 and 1000V Switches No fixed planned1 Not applicable
    Nexus 3000 Series and 9000 Series Switches 9.3(10)
    10.2(4)
    10.3(1)    		 9.3(11)2
    10.2(5)
    10.3(2)
    Nexus 5500 and 5600 Platform Switches and Nexus 6000 Series Switches 7.3(12)N1(1) Not applicable
    Nexus 7000 Series Switches 8.2(9)
    8.4(7)    		 8.4(7)
    1. All products in the Nexus 1000 product family have reached the End of Software Maintenance milestone in the end-of-life process. See End-of-Sale and End-of-Life Announcement for the Cisco Nexus 1000V Virtual Switch for VMware vSphere for details.
    2. Fixed releases of Cisco Nexus 3000 Series and 9000 Series Switches implement the enable cert-dn-match logic regardless of the configuration. This will be changed to be based off the enable cert-dn-match configuration parameter in a future release, which is tracked by CSCwe16785.

    The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.

    Additional Resources

    For help determining the best Cisco NX-OS Software release for a Cisco Nexus Switch, see the following Recommended Releases documents. If a security advisory recommends a later release, Cisco recommends following the advisory guidance.

    Cisco MDS Series Switches
    Cisco Nexus 1000V for VMware Switch
    Cisco Nexus 3000 Series Switches
    Cisco Nexus 5500 Platform Switches
    Cisco Nexus 5600 Platform Switches
    Cisco Nexus 6000 Series Switches
    Cisco Nexus 7000 Series Switches
    Cisco Nexus 9000 Series Switches
    Cisco Nexus 9000 Series ACI-Mode Switches

    To determine the best release for Cisco UCS Software, see the Recommended Releases documents in the release notes for the device.

Exploitation and Public Announcements

  • The Cisco PSIRT is not aware of any public announcements or malicious use of the issues that are described in this advisory.

Source

  • These issues were found during the resolution of a Cisco TAC support case.

Cisco Security Vulnerability Policy

  • To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

Subscribe to Cisco Security Notifications

Related to This Advisory

URL

Revision History

  • Version Description Section Status Date
    1.0 Initial public release. - Final 2023-FEB-22
    Show Less

Cisco Security Vulnerability Policy

  • To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.

Subscribe to Cisco Security Notifications

Related to This Advisory