Arista Networks EOS Multiple Vulnerabilities (SA0018) (DROWN)
medium Nessus Plugin ID 107060
Language:
New! Plugin Severity Now Using CVSS v3
The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Synopsis
The version of Arista Networks EOS running on the remote device is affected by multiple vulnerabilities.Description
The version of Arista Networks EOS running on the remote device is affected by multiple vulnerabilities in the included OpenSSL library :- A cipher algorithm downgrade vulnerability exists due to a flaw that is triggered when handling cipher negotiation. A remote attacker can exploit this to negotiate SSLv2 ciphers and complete SSLv2 handshakes even if all SSLv2 ciphers have been disabled on the server. Note that this vulnerability only exists if the SSL_OP_NO_SSLv2 option has not been disabled.
(CVE-2015-3197)
- A flaw exists in the SSLv2 implementation, specifically in the get_client_master_key() function within file s2_srvr.c, due to accepting a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value for an arbitrary cipher. A man-in-the-middle attacker can exploit this to determine the MASTER-KEY value and decrypt TLS ciphertext by leveraging a Bleichenbacher RSA padding oracle. (CVE-2016-0703)
- A flaw exists that allows a cross-protocol Bleichenbacher padding oracle attack known as DROWN (Decrypting RSA with Obsolete and Weakened eNcryption).
This vulnerability exists due to a flaw in the Secure Sockets Layer Version 2 (SSLv2) implementation, and it allows captured TLS traffic to be decrypted. A man-in-the-middle attacker can exploit this to decrypt the TSL connection by utilizing previously captured traffic and weak cryptography along with a series of specially crafted connections to an SSLv2 server that uses the same private key. (CVE-2016-0800)
Note that these issues occur only when CloudVision eXchange (CVX) is deployed as a virtual appliance and runs an EOS image. Therefore, only CVX features leveraging SSLv2 in the EOS releases are vulnerable.
Solution
Upgrade to Arista Networks EOS version 4.15.5M. Alternatively, apply the recommended mitigations referenced in the vendor advisory.See Also
http://www.nessus.org/u?fd4b2cf3
Plugin Details
Severity: Medium
ID: 107060
File Name: arista_eos_sa0018.nasl
Version: 1.8
Type: combined
Family: Misc.
Published: 2/28/2018
Updated: 3/13/2020
Dependencies: arista_eos_detect.nbin
Risk Information
CVSS Score Source: CVE-2016-0800
VPR
Risk Factor: Medium
Score: 6.1
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.2
Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Temporal Vector: E:U/RL:OF/RC:C
CVSS v3
Risk Factor: Medium
Base Score: 5.9
Temporal Score: 5.2
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:arista:eos
Required KB Items: Host/Arista-EOS/Version
Exploit Ease: No known exploits are available
Patch Publication Date: 3/7/2016
Vulnerability Publication Date: 1/28/2016