All,
How do I disable the CBC ciphers on a Nexus 7000?
Software
BIOS: version 2.12.0
kickstart: version 6.2(16)
system: version 6.2(16)
BIOS compile time: 05/29/2013
kickstart image file is: bootflash:///n7000-s2-kickstart.6.2.16.bin
kickstart compile time: 1/27/2016 9:00:00 [04/05/2016 17:13:37]
system image file is: bootflash:///n7000-s2-dk9.6.2.16.bin
system compile time: 1/27/2016 9:00:00 [04/05/2016 18:16:06]
Hardware
cisco Nexus7000 C7009 (9 Slot) Chassis ("Supervisor Module-2")
Nessus Plugin: 70658
Description
The SSH server is configured to support Cipher Block Chaining (CBC) encryption. This may allow an attacker to recover the plaintext message from the ciphertext.
Note that this plugin only checks for the options of the SSH server and does not check for vulnerable software versions.
Solution
Contact the vendor or consult product documentation to disable CBC mode cipher encryption, and enable CTR or GCM cipher mode encryption.
Output
-
The following client-to-server Cipher Block Chaining (CBC) algorithms
are supported :
3des-cbc
aes128-cbc
aes192-cbc
aes256-cbc
rijndael-cbc@lysator.liu.se
The following server-to-client Cipher Block Chaining (CBC) algorithms
are supported :
3des-cbc
aes128-cbc
aes192-cbc
aes256-cbc
rijndael-cbc@lysator.liu.se
Thanks in Advance,
Joe
