PAN-OS: Firewall Clusters using the MACsec Protocol Expose the Connectivity Association Key (CAK)
A problem with the implementation of the MACsec protocol in Palo Alto Networks PAN-OS® results in the cleartext exposure of the connectivity association key (CAK). This issue is only applicable to PA-7500 Series devices which are in an NGFW cluster.
A user who possesses this key can read messages being sent between devices in a NGFW Cluster. There is no impact in non-clustered firewalls or clusters of firewalls that do not enable MACsec.
PAN-OS: Firewall Clusters using the MACsec Protocol Expose the Connectivity Association Key (CAK)
A problem with the implementation of the MACsec protocol in Palo Alto Networks PAN-OS® results in the cleartext exposure of the connectivity association key (CAK). This issue is only applicable to PA-7500 Series devices which are in an NGFW cluster.
A user who possesses this key can read messages being sent between devices in a NGFW Cluster. There is no impact in non-clustered firewalls or clusters of firewalls that do not enable MACsec.
Version
Minor Version
Suggested Solution
Cloud NGFW
No action needed.
PAN-OS 11.2 on PA-7500
11.2.0 through 11.2.7
Upgrade to 11.2.8 or later.
PAN-OS 11.1 on PA-7500
11.1.0 through 11.1.9
Upgrade to 11.1.10 or later.
PAN-OS 10.2 on PA-7500
No action needed.PAN-OS 10.1 on PA-7500
No action needed.PAN-OS on devices other than PA-7500
No action needed.All older
unsupported
PAN-OS versions Upgrade to a supported fixed version.Prisma Access
No action needed.
Configurations
The following conditions must be true to be vulnerable to this issue:
* Your PA-7500 Series devices must be in an NGFW cluster. For more information regarding NGFW Clusters see our documentation https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/ngfw-clustering/ngfw-clusters .
* A MACsec policy must be configured and enabled for the NGFW cluster. For more information about MACsec profiles please see our documentation https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-web-interface-help/network/network-network-profiles/network-network-profiles-macsec-profile .
Workarounds
No known workarounds exist for this issue.
Exploits
Palo Alto Networks is not aware of any malicious exploitation of this issue.
Credits
finder
This issue was found during an internal security review.
A problem with the implementation of the MACsec protocol in Palo Alto Networks PAN-OS® results in the cleartext exposure of the connectivity association key (CAK). This issue is only applicable to PA-7500 Series devices which are in an NGFW cluster.
A user who possesses this key can read messages being sent between devices in a NGFW Cluster. There is no impact in non-clustered firewalls or clusters of firewalls that do not enable MACsec.