Cisco Security Advisory
Cisco NX-OS Software SSH X.509v3 Certificate Authentication with Unsupported Remote Authorization Method Privilege Escalation Issues
For certain products that are running Cisco NX-OS Software and are configured for SSH authentication with an X.509 version 3 (X.509v3) certificate, two remote authorization methods are unsupported and could allow for privilege escalation: TACACS+ and certain configurations of Lightweight Directory Access Protocol (LDAP).
- TACACS+ does not properly validate the distinguished name (DN) of the X.509v3 certificate due to a logic error with authentication, authorization, and accounting (AAA).
- LDAP does not properly validate the DN of the X.509v3 certificate if the enable cert-dn-match configuration command is not present. The enable cert-dn-match configuration command is required for username validation of the DN of the X.509v3 certificate.
Both unsupported configurations could allow a user who is authenticating to the device to elevate their privilege level to Administrator because the DN programmed username on the X.509v3 certificate was not validated and therefore did not have to match the username being authenticated.
Cisco has released software updates that address the TACACS+ and LDAP authorization issues, along with updates to the documentation for Cisco NX-OS Software. See Details for information about configuration changes that can address these security issues.
This advisory is available at the following link:
The following Cisco products are affected if they are running an affected release of Cisco NX-OS Software and they are configured for SSH authentication with X.509v3 certificates and remote authorization using TACACS+:
- MDS 9000 Series Multilayer Switches (CSCwd34476)
- Nexus 1000 Virtual Edge for VMware vSphere (CSCwc25702)
- Nexus 1000V Switch for Microsoft Hyper-V (CSCwc25702)
- Nexus 1000V Switch for VMware vSphere (CSCwc25702)
- Nexus 3000 Series Switches (CSCwc17000)
- Nexus 5500 Platform Switches (CSCwc25697)
- Nexus 5600 Platform Switches (CSCwc25697)
- Nexus 6000 Series Switches (CSCwc25697)
- Nexus 7000 Series Switches (CSCwc17198)
- Nexus 9000 Series Switches in standalone NX-OS mode (CSCwc17000)
For information on how to determine whether a product is using this unsupported configuration, see Determine Whether Unsupported TACACS+ Authorization with SSH X.509v3 Certificates is Configured.
The following Cisco products are affected if they are running an affected release of Cisco NX-OS Software and they are configured for SSH authorization with X.509v3 certificates and remote authorization using an unsupported configuration of LDAP:
- MDS 9000 Series Multilayer Switches (CSCwd34477)
- Nexus 3000 Series Switches (CSCwd31232)
- Nexus 7000 Series Switches (CSCwd31263)
- Nexus 9000 Series Switches in standalone NX-OS mode (CSCwd31232)
For information on how to determine whether a product is using this unsupported configuration, see Determine Whether LDAP Authorization with SSH X.509v3 Certificates is Using an Unsupported Configuration.
Determine Whether Unsupported TACACS+ Authorization with SSH X.509v3 Certificates is Configured
To determine whether a Cisco NX-OS device is configured to use TACACS+ for remote authorization, use the show running-config CLI command. The configuration is unsupported and the device is affected if the following CLI commands are present:
- aaa authorization ssh-certificate default group groupname where the AAA group is configured for TACACS+
- aaa group server tacacs+ groupname
The CLI of a device that is running a fixed release of Cisco NX-OS Software would not accept the unsupported configuration. The following example shows the error message that would be returned on a device that is running a fixed release:
Enter configuration commands, one per line. End with CNTL/Z.
nxos(config)# aaa authorization ssh-certificate default group tacacs1
aaa function not supported by configured method
could not update aaa configuration
When a device is upgraded to a fixed release of Cisco NX-OS Software, any existing aaa authorization ssh-certificate default group groupname commands where the AAA group is configured for TACACS+ are removed from the configuration.
Determine Whether LDAP Authorization with SSH X.509v3 Certificates is Using an Unsupported Configuration
To determine whether a Cisco NX-OS device is configured to use LDAP for remote authorization, use the show running-config CLI command. The configuration is unsupported and the device is affected if the following conditions are true:
- The CLI command aaa authorization ssh-certificate default group groupname where the AAA group is configured for LDAP is present.
- The CLI command aaa group server ldap groupname is configured.
- The LDAP configuration does not contain enable cert-dn-match.
A device is running a supported configuration and is not affected if the CLI command show running-config ldap | include cert-dn-match returns output, as in the following example:
nxos# show running-config ldap | include cert-dn-match
For MDS 9000 Series and Nexus 7000 Series switches that are running a fixed release of Cisco NX-OS Software, the enable cert-dn-match configuration is enabled by default. Cisco recommends keeping this configuration enabled. For Nexus 3000 Series and 9000 Series switches that are running a fixed release, the enable cert-dn-match logic is always implemented, regardless of whether enable cert-dn-match is present in the configuration.
Products Confirmed Not Vulnerable
Only products listed in the Vulnerable Products section of this advisory are known to be affected by these issues.
Cisco has confirmed that these issues do not affect the following Cisco products:
- Firepower 1000 Series
- Firepower 2100 Series
- Firepower 4100 Series
- Firepower 9300 Security Appliances
- Nexus 9000 Series Fabric Switches in ACI mode
- UCS 6200 Series Fabric Interconnects
- UCS 6300 Series Fabric Interconnects
- UCS 6400 Series Fabric Interconnects
- UCS 6500 Series Fabric Interconnects
Cisco recommends the following configuration changes to prevent the security issues that are explained in this advisory:
- SSH with X.509v3 certificate-based authentication and TACACS+ authorization is unsupported. If the device requires X.509v3 certificate-based authentication, the only valid remote authorization option is LDAP. Use the NX-OS CLI command aaa authorization ssh-certificate default group groupname to reconfigure the AAA group from TACACS+ to LDAP.
- If NX-OS CLI command aaa authorization ssh-certificate default group groupname is configured and the AAA group is configured for LDAP, add the enable cert-dn-match configuration command. Otherwise, this is an unsupported configuration.
When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
The left column lists Cisco NX-OS products. The middle and right columns indicate whether the product is affected by the security issues that are described in this advisory and which releases prevent the issues for the specified remote authorization configuration.
Cisco NX-OS Product First Fixed Release for TACACS+ First Fixed Release for LDAP MDS 9000 Series Multilayer Switches 8.4(2f) (March 2023)
8.4(2f) (March 2023)
Nexus 1000 and 1000V Switches No fixed planned1 Not applicable Nexus 3000 Series and 9000 Series Switches 9.3(10)
Nexus 5500 and 5600 Platform Switches and Nexus 6000 Series Switches 7.3(12)N1(1) Not applicable Nexus 7000 Series Switches 8.2(9)
8.4(7)1. All products in the Nexus 1000 product family have reached the End of Software Maintenance milestone in the end-of-life process. See End-of-Sale and End-of-Life Announcement for the Cisco Nexus 1000V Virtual Switch for VMware vSphere for details.2. Fixed releases of Cisco Nexus 3000 Series and 9000 Series Switches implement the enable cert-dn-match logic regardless of the configuration. This will be changed to be based off the enable cert-dn-match configuration parameter in a future release, which is tracked by CSCwe16785.
The Cisco Product Security Incident Response Team (PSIRT) validates only the affected and fixed release information that is documented in this advisory.
For help determining the best Cisco NX-OS Software release for a Cisco Nexus Switch, see the following Recommended Releases documents. If a security advisory recommends a later release, Cisco recommends following the advisory guidance.
Cisco MDS Series Switches
Cisco Nexus 1000V for VMware Switch
Cisco Nexus 3000 Series Switches
Cisco Nexus 5500 Platform Switches
Cisco Nexus 5600 Platform Switches
Cisco Nexus 6000 Series Switches
Cisco Nexus 7000 Series Switches
Cisco Nexus 9000 Series Switches
Cisco Nexus 9000 Series ACI-Mode Switches
To determine the best release for Cisco UCS Software, see the Recommended Releases documents in the release notes for the device.
The Cisco PSIRT is not aware of any public announcements or malicious use of the issues that are described in this advisory.
These issues were found during the resolution of a Cisco TAC support case.
To learn about Cisco security vulnerability disclosure policies and publications, see the Security Vulnerability Policy. This document also contains instructions for obtaining fixed software and receiving security vulnerability information from Cisco.
Version Description Section Status Date 1.0 Initial public release. - Final 2023-FEB-22
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.