Arista Networks EOS Multiple Vulnerabilities (SA0018) (DROWN)

medium Nessus Plugin ID 107060

Synopsis

The version of Arista Networks EOS running on the remote device is affected by multiple vulnerabilities.

Description

The version of Arista Networks EOS running on the remote device is affected by multiple vulnerabilities in the included OpenSSL library :

- A cipher algorithm downgrade vulnerability exists due to a flaw that is triggered when handling cipher negotiation. A remote attacker can exploit this to negotiate SSLv2 ciphers and complete SSLv2 handshakes even if all SSLv2 ciphers have been disabled on the server. Note that this vulnerability only exists if the SSL_OP_NO_SSLv2 option has not been disabled.
(CVE-2015-3197)

- A flaw exists in the SSLv2 implementation, specifically in the get_client_master_key() function within file s2_srvr.c, due to accepting a nonzero CLIENT-MASTER-KEY CLEAR-KEY-LENGTH value for an arbitrary cipher. A man-in-the-middle attacker can exploit this to determine the MASTER-KEY value and decrypt TLS ciphertext by leveraging a Bleichenbacher RSA padding oracle. (CVE-2016-0703)

- A flaw exists that allows a cross-protocol Bleichenbacher padding oracle attack known as DROWN (Decrypting RSA with Obsolete and Weakened eNcryption).
This vulnerability exists due to a flaw in the Secure Sockets Layer Version 2 (SSLv2) implementation, and it allows captured TLS traffic to be decrypted. A man-in-the-middle attacker can exploit this to decrypt the TSL connection by utilizing previously captured traffic and weak cryptography along with a series of specially crafted connections to an SSLv2 server that uses the same private key. (CVE-2016-0800)

Note that these issues occur only when CloudVision eXchange (CVX) is deployed as a virtual appliance and runs an EOS image. Therefore, only CVX features leveraging SSLv2 in the EOS releases are vulnerable.

Solution

Upgrade to Arista Networks EOS version 4.15.5M. Alternatively, apply the recommended mitigations referenced in the vendor advisory.

See Also

https://www.drownattack.com/drown-attack-paper.pdf

https://drownattack.com/

https://www.openssl.org/news/secadv/20160301.txt

http://www.nessus.org/u?fd4b2cf3

Plugin Details

Severity: Medium

ID: 107060

File Name: arista_eos_sa0018.nasl

Version: 1.8

Type: combined

Family: Misc.

Published: 2/28/2018

Updated: 3/13/2020

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2016-0800

CVSS v3

Risk Factor: Medium

Base Score: 5.9

Temporal Score: 5.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:arista:eos

Required KB Items: Host/Arista-EOS/Version

Exploit Ease: No known exploits are available

Patch Publication Date: 3/7/2016

Vulnerability Publication Date: 1/28/2016

Reference Information

CVE: CVE-2015-3197, CVE-2016-0703, CVE-2016-0800

BID: 82237, 83733, 83743

CERT: 257823, 583776