Arista Networks EOS Multiple Vulnerabilities (SA0018) (DROWN)
medium Nessus Plugin ID 107060
Language:
New! Vulnerability Priority Rating (VPR)
Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it is different from CVSS.
VPR Score: 4.4
Synopsis
The version of Arista Networks EOS running on the remote device is affected by multiple vulnerabilities.Description
The version of Arista Networks EOS running on the remote device is affected by multiple vulnerabilities in the included OpenSSL library :- A cipher algorithm downgrade vulnerability exists due to a flaw that is triggered when handling cipher negotiation. A remote attacker can exploit this to negotiate SSLv2 ciphers and complete SSLv2 handshakes even if all SSLv2 ciphers have been disabled on the server. Note that this vulnerability only exists if the SSL_OP_NO_SSLv2 option has not been disabled.
(CVE-2015-3197)
- A flaw exists in the SSLv2 implementation, specifically in the get_client_master_key() function within file s2_srvr.c, due to accepting a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value for an arbitrary cipher. A man-in-the-middle attacker can exploit this to determine the MASTER-KEY value and decrypt TLS ciphertext by leveraging a Bleichenbacher RSA padding oracle. (CVE-2016-0703)
- A flaw exists that allows a cross-protocol Bleichenbacher padding oracle attack known as DROWN (Decrypting RSA with Obsolete and Weakened eNcryption).
This vulnerability exists due to a flaw in the Secure Sockets Layer Version 2 (SSLv2) implementation, and it allows captured TLS traffic to be decrypted. A man-in-the-middle attacker can exploit this to decrypt the TSL connection by utilizing previously captured traffic and weak cryptography along with a series of specially crafted connections to an SSLv2 server that uses the same private key. (CVE-2016-0800)
Note that these issues occur only when CloudVision eXchange (CVX) is deployed as a virtual appliance and runs an EOS image. Therefore, only CVX features leveraging SSLv2 in the EOS releases are vulnerable.
Solution
Upgrade to Arista Networks EOS version 4.15.5M. Alternatively, apply the recommended mitigations referenced in the vendor advisory.See Also
http://www.nessus.org/u?fd4b2cf3
Plugin Details
Severity: Medium
ID: 107060
File Name: arista_eos_sa0018.nasl
Version: 1.8
Type: combined
Family: Misc.
Published: 2/28/2018
Updated: 3/13/2020
Dependencies: 107070
Risk Information
Risk Factor: Medium
VPR Score: 4.4
CVSS Score Source: CVE-2016-0800
CVSS v2.0
Base Score: 4.3
Temporal Score: 3.2
Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
Temporal Vector: E:U/RL:OF/RC:C
CVSS v3.0
Base Score: 5.9
Temporal Score: 5.2
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:arista:eos
Required KB Items: Host/Arista-EOS/Version
Exploit Ease: No known exploits are available
Patch Publication Date: 3/7/2016
Vulnerability Publication Date: 1/28/2016