ESB-2023.3818.3 – UPDATE [Cisco] Cisco ACI Multi-Site CloudSec: CVSS (Max): 7.4 [auscert.org.au]

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

===========================================================================
AUSCERT External Security Bulletin Redistribution

ESB-2023.3818.3
Cisco ACI Multi-Site CloudSec Encryption Information
Disclosure Vulnerability
10 July 2023

===========================================================================

AusCERT Security Bulletin Summary
———————————

Product: Cisco ACI Multi-Site CloudSec
Publisher: Cisco Systems
Operating System: Cisco
Resolution: None
CVE Names: CVE-2023-20185

Original Bulletin:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aci-cloudsec-enc-Vs5Wn2sX

Comment: CVSS (Max): 7.4 CVE-2023-20185 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVSS Source: Cisco Systems
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Revision History: July 10 2023: Vendor clarified information about no fix availability and customer guidance
July 7 2023: Fixed the resolution to None
July 6 2023: Initial Release

– ————————–BEGIN INCLUDED TEXT——————–

Cisco ACI Multi-Site CloudSec Encryption Information Disclosure Vulnerability

Priority: High
Advisory ID: cisco-sa-aci-cloudsec-enc-Vs5Wn2sX
First Published: 2023 July 5 16:00 GMT
Last Updated: 2023 July 8 14:43 GMT
Version 1.1: Final
Workarounds: No workarounds available
Cisco Bug IDs: CSCwf02544
CVE Names: CVE-2023-20185

Summary

o A vulnerability in the Cisco ACI Multi-Site CloudSec encryption feature of
Cisco Nexus 9000 Series Fabric Switches in ACI mode could allow an
unauthenticated, remote attacker to read or modify intersite encrypted
traffic.

This vulnerability is due to an issue with the implementation of the
ciphers that are used by the CloudSec encryption feature on affected
switches. An attacker with an on-path position between the ACI sites could
exploit this vulnerability by intercepting intersite encrypted traffic and
using cryptanalytic techniques to break the encryption. A successful
exploit could allow the attacker to read or modify the traffic that is
transmitted between the sites.

Cisco has not released and will not release software updates that address
this vulnerability. There are no workarounds that address this
vulnerability.

This advisory is available at the following link:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aci-cloudsec-enc-Vs5Wn2sX

Affected Products

o Vulnerable Products

This vulnerability affects Cisco Nexus 9000 Series Fabric Switches in ACI
mode that are running releases 14.0 and later if they are part of a
Multi-Site topology and have the CloudSec encryption feature enabled.

Determine the Status of the CloudSec Feature

CloudSec encryption currently requires using Cisco Nexus 9332C or Cisco
Nexus 9364C Fixed Spine Switches, or Cisco Nexus 9500 Spine Switches that
are equipped with a Cisco Nexus N9K-X9736C-FX Line Card.

To determine whether CloudSec encryption is in use in an ACI site, choose
Infrastructure > Site Connectivity > Configure > Sites > site-name >
Inter-Site Connectivity on the Cisco Nexus Dashboard Orchestrator (NDO) and
check if CloudSec Encryption is marked Enabled .

To determine whether CloudSec encryption is in use on a Cisco Nexus 9000
Series Spine Switch, use the show cloudsec sa interface all command at the
switch CLI. If the command returns Operational Status output for any
interface, CloudSec encryption is enabled, as shown in the following
example:

POD1-SPINE1# show cloudsec sa interface all
================================================================================
Interface: Eth1/63.63(0x1a03e03f) Physical Interface: Eth1/63(0x1a03e000)
Operational Status: UP Retry: Off Control: deprecatedUdpPort
——————————————————————————–
Site-Id: 2 Peer: 172.16.200.200/32 Type: msite-multicast-tep Operational Status: UP
——————————————————————————–
.
.
.

Products Confirmed Not Vulnerable

Only products listed in the Vulnerable Products section of this advisory
are known to be affected by this vulnerability.

Cisco has confirmed that this vulnerability does not affect Cisco Nexus
9000 Series Switches in standalone NX-OS mode.

Workarounds

o There are no workarounds that address this vulnerability.

Fixed Software

o Cisco has not released and will not release software updates to address the
vulnerability that is described in this advisory. Customers who are using
the Cisco ACI Multi-Site CloudSec encryption feature for the Cisco Nexus
9332C and Nexus 9364C Switches and the Cisco Nexus N9K-X9736C-FX Line Card
are advised to disable this feature and to contact their support
organization to evaluate alternative options, such as performing encryption
on the underlying site-to-site connections. There are no alternatives that
provide full encryption for data in transit between sites on current ACI
Spine Switches hardware.

When considering software upgrades , customers are advised to regularly
consult the advisories for Cisco products, which are available from the
Cisco Security Advisories page , to determine exposure and a complete
upgrade solution.

In all cases, customers should ensure that the devices to be upgraded
contain sufficient memory and confirm that current hardware and software
configurations will continue to be supported properly by the new release.
If the information is not clear, customers are advised to contact the Cisco
Technical Assistance Center (TAC) or their contracted maintenance
providers.

Additional Resources

For help determining the best Cisco NX-OS Software release for a Cisco
Nexus Switch, see the following Recommended Releases documents. If a
security advisory recommends a later release, Cisco recommends following
the advisory guidance.

Cisco MDS Series Switches
Cisco Nexus 1000V for VMware Switch
Cisco Nexus 3000 Series Switches
Cisco Nexus 5500 Platform Switches
Cisco Nexus 5600 Platform Switches
Cisco Nexus 6000 Series Switches
Cisco Nexus 7000 Series Switches
Cisco Nexus 9000 Series Switches
Cisco Nexus 9000 Series ACI-Mode Switches

Exploitation and Public Announcements

o The Cisco Product Security Incident Response Team (PSIRT) is not aware of
any public announcements or malicious use of the vulnerability that is
described in this advisory.

Source

o This vulnerability was found during internal security testing.

Cisco Security Vulnerability Policy

o To learn about Cisco security vulnerability disclosure policies and
publications, see the Security Vulnerability Policy . This document also
contains instructions for obtaining fixed software and receiving security
vulnerability information from Cisco.

Subscribe to Cisco Security Notifications

o Subscribe

Related to This Advisory

URL

o https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-aci-cloudsec-enc-Vs5Wn2sX

Revision History

Legal Disclaimer

o THIS DOCUMENT IS PROVIDED ON AN “AS IS” BASIS AND DOES NOT IMPLY ANY KIND
OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR
FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT
OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES
THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.

A standalone copy or paraphrase of the text of this document that omits the
distribution URL is an uncontrolled copy and may lack important information
or contain factual errors. The information in this document is intended for
end users of Cisco products.

– ————————–END INCLUDED TEXT——————–

You have received this e-mail bulletin as a result of your organisation’s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to [email protected]
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT’s members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation’s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author’s website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: [email protected]
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
—–BEGIN PGP SIGNATURE—–
Comment: https://auscert.org.au/gpg-key/

iQIVAwUBZKt7XskNZI30y1K9AQgbMw/+P+Yv1t+08nL0PgdWgZt8qlR3axVZyLbQ
3MG/nJdnZeLYv44dU2vLStseKIOyz8HBUGPf3da1Gb+HnUo4gMyViFGbaIszkNYB
rbRWyAzNwHKHacE4Yv8tVvepH+ewXRES0JjKlNDMvf9yKZeCvtfFn5foMvC8+b2O
EtZrG/Q3TVIzFRNkImKLxqaqTx7SZo1F+bLpqSuxnb4RrktP1Bz8/fSTktriP5n9
6XGoVE1N8PI3JIujaalu9UmHfDqmL4Xdq0WIn/6ECEJW3IaMn058UKTc9G6dH7sQ
KI6jVXYZyvnsRyThjzAqYn6lQzLrlv1hlLSI+vJsz2YR7nluTOzTuXvFIqrrnnHx
LumAWXrbAkO2vUqlsfiyibGvRg5tmJD9a44Xl6qX1ZN7u5Fl0mOGuz1oR8XdZuDT
wSDkUk30tPH5fzOSITpQHar3MtdQiqyYq+FnP0FYSw1hpOO/ivDEDIz15S+bIUUy
V3mZeg2nGpLdC20GancHCruibQPZPOdUic+6Rq8ZmRdWdG6S6i2b06pHooANGAqE
AEFAxjbCY479+q4dU2wsVB17IHGA0oo+XvaV3hA8YJjHOPOI01icsw8ZLDGqYgHk
RegTmJ43CxTe3nGxPaql/XHJvQikJLRLnudD0AIeBREc6Rw8KwZy4B9BgQsPC1WK
AEESnEU3SkY=
=OHcs
—–END PGP SIGNATURE—–

Source: Read More

Security Bulletins

Leave a Comment Cancel reply