Incomplete Log Sanitization in Brocade SANnav Exposes IPsec Pre-Shared Keys

Executive Summary

This vulnerability involves incomplete log sanitization in Brocade SANnav versions before 3.0.1a during bulk IPsec policy collection. It allows extension switch pre-shared keys to be written to system logs. Attackers with read access to container logs or support archives could extract these keys and potentially compromise encrypted network tunnels.

Useful 0 Not Useful 0

Detection Guidance

Check Brocade SANnav container logs for exposed pre-shared keys. Search logs for IPsec policy collection entries or sensitive key material. Use commands like 'docker logs <container_name>' or 'kubectl logs <pod_name>' to inspect logs. Look for plaintext keys in log files or support archives.

Useful 0 Not Useful 0

Impact Analysis

If you use Brocade SANnav versions before 3.0.1a, an attacker with log access could obtain pre-shared keys for IPsec tunnels. This could lead to unauthorized access to encrypted network communications, data breaches, or man-in-the-middle attacks on your network infrastructure.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data transmitted over IPsec tunnels, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations may face compliance violations, fines, or legal consequences if such breaches occur due to inadequate security measures.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Brocade SANnav to version 3.0.1a or later. Restrict access to container logs and support archives. Rotate all IPsec pre-shared keys if they may have been exposed. Review and sanitize existing logs to remove any exposed keys.

Useful 0 Not Useful 0