Arista Networks EOS Multiple Vulnerabilities (SA0018) (DROWN)

medium Nessus Plugin ID 107060
New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.


The version of Arista Networks EOS running on the remote device is affected by multiple vulnerabilities.


The version of Arista Networks EOS running on the remote device is affected by multiple vulnerabilities in the included OpenSSL library :

- A cipher algorithm downgrade vulnerability exists due to a flaw that is triggered when handling cipher negotiation. A remote attacker can exploit this to negotiate SSLv2 ciphers and complete SSLv2 handshakes even if all SSLv2 ciphers have been disabled on the server. Note that this vulnerability only exists if the SSL_OP_NO_SSLv2 option has not been disabled.

- A flaw exists in the SSLv2 implementation, specifically in the get_client_master_key() function within file s2_srvr.c, due to accepting a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value for an arbitrary cipher. A man-in-the-middle attacker can exploit this to determine the MASTER-KEY value and decrypt TLS ciphertext by leveraging a Bleichenbacher RSA padding oracle. (CVE-2016-0703)

- A flaw exists that allows a cross-protocol Bleichenbacher padding oracle attack known as DROWN (Decrypting RSA with Obsolete and Weakened eNcryption).
This vulnerability exists due to a flaw in the Secure Sockets Layer Version 2 (SSLv2) implementation, and it allows captured TLS traffic to be decrypted. A man-in-the-middle attacker can exploit this to decrypt the TSL connection by utilizing previously captured traffic and weak cryptography along with a series of specially crafted connections to an SSLv2 server that uses the same private key. (CVE-2016-0800)

Note that these issues occur only when CloudVision eXchange (CVX) is deployed as a virtual appliance and runs an EOS image. Therefore, only CVX features leveraging SSLv2 in the EOS releases are vulnerable.


Upgrade to Arista Networks EOS version 4.15.5M. Alternatively, apply the recommended mitigations referenced in the vendor advisory.

See Also

Plugin Details

Severity: Medium

ID: 107060

File Name: arista_eos_sa0018.nasl

Version: 1.8

Type: combined

Family: Misc.

Published: 2/28/2018

Updated: 3/13/2020

Dependencies: arista_eos_detect.nbin

Risk Information

CVSS Score Source: CVE-2016-0800


Risk Factor: Medium

Score: 5.1


Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

Temporal Vector: E:U/RL:OF/RC:C


Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:arista:eos

Required KB Items: Host/Arista-EOS/Version

Exploit Ease: No known exploits are available

Patch Publication Date: 3/7/2016

Vulnerability Publication Date: 1/28/2016

Reference Information

CVE: CVE-2015-3197, CVE-2016-0703, CVE-2016-0800

BID: 82237, 83733, 83743

CERT: 257823, 583776