The remote device running Arista Networks EOS is affected by multiple vulnerabilities in its HTTP/2 implementation, potentially leading to denial of service attacks
#TRUSTED 9854d4a035645598d6d4a2bf77d33726ad7be07f9a2506ff2dea1bc45491e6cf84fd69657834f672d1d627b73ddf07257c6c246cca0fc7ef43e14882225df2f71ff56a05ac823d1666132d3f1329fb6632897dea66e8a225e5d5e1220e4dd5a35caf6a7fed6fc33e941387d2bafcdebf16734bad3e40dcbc4b3e9c808e0851f34fded1f8c4dc17d18a8b36d7a5825254cc98578421b91ed7e40ab2a91e4f6ac018fb09043f6c2a141ba8dea2f5399404e7198e093b29ac304120c0abf0278d26e646faeca81cb2a65c040427ecf56bf284e75a913e1dbc3e2bbca524df97fff9c3684ecfd1c6fdc96523d54886e2d5dc178f0db81b091a26bf8c9aa48d67cefe365b896cda4af6681c8efb39d19185c5f6ccb4b1279564df8a4b29fb6886fb20d291cfa0d49eb9db0830fd25944f9a39763d4369c41ece17232a8b689d17f81f7d22bbbcacdd2cc9b7cab1f09b74da94afe8eb28e9388681910d3f63986d0bf9e87b7ae582fe1f8241a7b64000183c9679f2fada022d064b355048e5dc35694b2b6986b6acfe6d30045ce40c6d50589b4c833eadeb133273f736df82a3925fb7393b14e654ebd7cc03ef3c2e93c287b52ed9fcd6de55c2b380c0b4313f83a73c16c27af8a2a9208573ac63f088fa817f223421bd610267d483040f56062c2602df526d65e7ff6f840309175c177d15681ed60a5af11d07435ae1deb172dbe663
#TRUST-RSA-SHA256 6e23649d7b989a7a0bb196ddb259488b534f6939a0c906d997aa311fa89856f78f4c2ceaf85e024da2b5e77605f16182a6e7623afdb31df019d1a0279419e05a5f3cc24fc313ae9592a411fabf9a4c0e55d1f24a3ef7a6aa5c390652c307d3d1ab512b078624033877ae145dc7a7a0f1ffa89969a361c1d989f24ec71fd8e6e1632636fbcfb4932bde51b26b37baf441e89dc723aabaa7edf75a5ad881654c8bd66e406f7de212e42c9da9ae1dcf034422d4306ec55cdeff192cabffe2ee36a8edc06bd40f94aff3e90891d6996189f1c522d16b7745f70e230a5dc40cec9c1e3f6e584c0b3dcf2a9e4ca7728e8bf80ba58ff92b482286faee17c0dc56bb6f3fdb45dae0bb353918033c16e88edfe65757ce73360053992ca675865ed6cb4617e70c1bea0663172b91d150b5c8b6483040de1fab2550ad7adab4b8ba0618316a5d5c671a8e9ab7cfe07533a13b0fbf55535b5c66dbefa57f67ff82ccac8778cb9a57f4fe7365bdb942c2b08512c5190411649ac680f7736b1803d40d1d4d66ef6d2e42fe57e3688330cb97ce1a867bce21348395c3629ba910c050dd13b7878cbad66579db24229915ec99bc04b5c559c28be86a1b89fa4f4b6c659b7f5525bea6feb9d2f89d4ffa8173816a8ac314e23831b239a4996763db51ce95a9286bfce55c936f55e51b291edcc1d8b63de9daa8e46901d9a81080f9c773c26a1ca83c
#
# (C) Tenable Network Security, Inc.
#
include('compat.inc');
if (description)
{
script_id(134419);
script_version("1.6");
script_set_attribute(attribute:"plugin_modification_date", value:"2022/12/06");
script_cve_id("CVE-2019-9512", "CVE-2019-9514", "CVE-2019-9515");
script_xref(name:"CEA-ID", value:"CEA-2019-0643");
script_name(english:"Arista Networks EOS Multiple Vulnerabilities (SA0043)");
script_set_attribute(attribute:"synopsis", value:
"The version of Arista Networks EOS running on the remote device is affected by multiple vulnerabilities.");
script_set_attribute(attribute:"description", value:
"The version of Arista Networks EOS running on the remote device is affected by the following vulnerabilities:
- HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service (DoS).
An unauthenticated, remote attacker can exploit this, by sending continual pings to an HTTP/2 peer,
causing the peer to build an internal queue of responses. Depending on how efficiently this data is
queued, this can consume excess CPU, memory, or both. (CVE-2019-9512)
- HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a DoS. An unauthenticated,
remote attacker can open a number of streams and send an invalid request over each stream that should
solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM
frames, this can consume excess memory, CPU, or both. (CVE-2019-9514)
- HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a DoS. An
unauthenticated, remote attacker can exploit this by sending a stream of SETTINGS frames to the peer.
Since the RFC requires that the peer reply with one acknowledgement per SETTINGS frame, an empty SETTINGS
frame is almost equivalent in behavior to a ping. Depending on how efficiently this data is queued, this
can consume excess CPU, memory, or both. (CVE-2019-9515)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
# https://www.arista.com/en/support/advisories-notices/security-advisories/8762-security-advisory-43
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e5070013");
script_set_attribute(attribute:"solution", value:
"Apply the patch or or mitigation or upgrade to a fixed version as referenced in the vendor advisory.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-9515");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"vuln_publication_date", value:"2019/08/13");
script_set_attribute(attribute:"patch_publication_date", value:"2019/11/06");
script_set_attribute(attribute:"plugin_publication_date", value:"2020/03/11");
script_set_attribute(attribute:"potential_vulnerability", value:"true");
script_set_attribute(attribute:"plugin_type", value:"combined");
script_set_attribute(attribute:"cpe", value:"cpe:/o:arista:eos");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Misc.");
script_copyright(english:"This script is Copyright (C) 2020-2022 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("arista_eos_detect.nbin");
script_require_keys("Host/Arista-EOS/Version", "Settings/ParanoidReport");
exit(0);
}
include('arista_eos_func.inc');
include('audit.inc');
if (report_paranoia < 2)
audit(AUDIT_PARANOID);
version = get_kb_item_or_exit('Host/Arista-EOS/Version');
if (version =~ "([^0-9]|^)4\.22\.(0|0\.1|0\.2|1|2)F" ||
version =~ "([^0-9]|^)4\.23\.(0|0\.1)F")
{
ext='SecurityAdvisory0043Hotfix-4.22-4.23.rpm 1.0.0/eng';
sha='ef84fb5e4eb2ffe9f1cf2904cb1b496fb115c444de21f4cf38858daa4a0cba35a6cad9677d01b8f1885df42ff15368c864998eb4afcc7625e39195e08f65c669';
if(eos_extension_installed(ext:ext, sha:sha))
audit(AUDIT_HOST_NOT, 'affected as a relevant hotfix has been installed');
}
else if (version =~ "([^0-9]|^)4\.20\.(11|11\.1|12|12\.1|13|13\.1|14)M" ||
version =~ "([^0-9]|^)4\.21\.(7|7\.1|8)M")
{
ext='SecurityAdvisory0043Hotfix-4.20-4.21.rpm 1.0.0/eng';
sha='be17fce400045ee63c7d77cb756e47aebf460c878793b1984ed3c79f7c3be3ec189c986afdcbc3d1814170d2e1f5c594b3ac7d179ebe05eda05c4919d9789036';
if(eos_extension_installed(ext:ext, sha:sha))
audit(AUDIT_HOST_NOT, 'affected as a relevant hotfix has been installed');
}
vmatrix = make_array();
vmatrix['all'] = make_list('4.22<=4.22.2',
'4.21<=4.21.7.1',
'4.20<=4.20.14',
'4.19<=4.19.13',
'4.18<=4.18.99',
'4.17<=4.17.99');
vmatrix['F'] = make_list('4.23.0F');
vmatrix['fix'] = '4.20 >= 4.20.15M / 4.21 >= 4.21.9M / 4.22 >= 4.22.3F / 4.23 >= 4.23.1F';
if (eos_is_affected(vmatrix:vmatrix, version:version))
security_report_v4(severity:SECURITY_HOLE, port:0, extra:eos_report_get());
else
audit(AUDIT_INST_VER_NOT_VULN, 'Arista Networks EOS', version);
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo