CVE-2020-15897

CVE-2020-15897 affects Arista EOS where malformed IS-IS link-state PDUs can cause traffic loss or incorrect forwarding. Affected EOS versions are 4.21.12M and all 4.22.x prior to 4.22.7M, all 4.23.x prior to 4.23.5M, and all 4.24.x prior to 4.24.2F. The issue arises in the IS-IS router when proce...

CVE-2020-17355

Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause a denial of service restart of agents by crafting a malformed DHCP packet which leads to an incorrect route being installed...

CVE-2020-17355

Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause a denial of service restart of agents by crafting a malformed DHCP packet which leads to an incorrect route being installed...

Code injection

Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause a denial of service restart of agents by crafting a malformed DHCP packet which leads to an incorrect route being installed...

CVE-2020-17355

CVE-2020-17355 affects Arista EOS: vulnerability in DHCP relay handling where a malformed DHCP packet can install an incorrect route, triggering DoS via agent restarts (SandL3Unicast, Ira, Arp, Snmp). Affected EOS releases are 4.24.x before 4.24.2F, 4.23.x before 4.23.5M, 4.22.x before 4.22.7M, a...

CVE-2020-17355

Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause a denial of service restart of agents by crafting a malformed DHCP packet which leads to an incorrect route being installed...

Vulnerabilities fixed in Arista EOS

Arista has fixed several vulnerabilities in EOS. The vulnerabilities allow a malicious party to perform a Denial-of-Service DoS exploit. To do this, malicious network traffic to the device. Arista has released updates to fix the vulnerabilities. For more information, see: CVE-2020-15897:...

Security Advisory 0054

Security Advisory 0054 PDF Date: October 7th, 2020 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | October 7th, 2020 | Initial Release The CVE-ID tracking this issue is: CVE-2020-15897 CVSSv3.1 Base Score: 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description This advisory documen...

Security Advisory 0053

Security Advisory 0053 PDF Date: October 7th, 2020 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | October 7th, 2020 | Initial Release The CVE-ID tracking this issue is: CVE-2020-17355 CVSSv3 Base Score: 7.5/10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Description This advisory...

sk.eos-solutions.com Cross Site Scripting vulnerability OBB-1279595

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

eos buffer error vulnerability

eos is an open source smart contract platform. A stack overflow vulnerability exists in the 'abiserializer' function in versions after eos commit f1545dd0ae2b77580c2236fdb70ae7138d2c7168. An attacker can exploit this vulnerability by sending a network request to attack an eos network node...

CVE-2020-11622

A vulnerability exists in Arista’s Cloud EOS VM / vEOS 4.23.2M and below releases in the 4.23.x train, 4.22.4M and below releases in the 4.22.x train, 4.21.3M to 4.21.9M releases in the 4.21.x train, 4.21.3FX-7368., 4.21.4-FCRFX., 4.21.4.1, 4.21.7.1, 4.22.2.0.1, 4.22.2.2.1, 4.22.3.1, and 4.23.2.1...

Design/Logic Flaw

A vulnerability exists in Arista’s Cloud EOS VM / vEOS 4.23.2M and below releases in the 4.23.x train, 4.22.4M and below releases in the 4.22.x train, 4.21.3M to 4.21.9M releases in the 4.21.x train, 4.21.3FX-7368., 4.21.4-FCRFX., 4.21.4.1, 4.21.7.1, 4.22.2.0.1, 4.22.2.2.1, 4.22.3.1, and 4.23.2.1...

CVE-2020-11622

The CVE concerns Arista CloudEOS VM / vEOS Router code when TCP MSS options are configured. Affected releases include CloudEOS VM / vEOS Router: 4.23.2M and below in 4.23.x, 4.22.4M and below in 4.22.x, 4.21.3M–4.21.9M in 4.21.x, plus special builds 4.21.3FX-7368., 4.21.4-FCRFX. , 4.21.4.1, 4.21....

CVE-2020-11622

A vulnerability exists in Arista’s Cloud EOS VM / vEOS 4.23.2M and below releases in the 4.23.x train, 4.22.4M and below releases in the 4.22.x train, 4.21.3M to 4.21.9M releases in the 4.21.x train, 4.21.3FX-7368., 4.21.4-FCRFX., 4.21.4.1, 4.21.7.1, 4.22.2.0.1, 4.22.2.2.1, 4.22.3.1, and 4.23.2.1...

eos buffer overflow vulnerability

eos is an open source smart contract platform. A stack overflow vulnerability exists in the 'abiserializer' function in versions after eos commit f1545dd0ae2b77580c2236fdb70ae7138d2c7168. An attacker can exploit this vulnerability by sending a network request to attack an eos network node...

Security Advisory 0048

Security Advisory 0048 PDF Date: May 13, 2020 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | May 13, 2020 | Initial Release The CVE-ID tracking this issue: CVE-2020-10188 CVSSv3 Base Score: 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Description: This security advisory documents the exposur...

EOS has a fake recharge vulnerability

EOS is a blockchain operating system designed for commercial distributed applications. The vulnerability stems from an improper configuration of a specific parameter delay-sec in cleos. An attacker could use this vulnerability to increase the amount of tokens in an individual's account with a fal...

CVE-2019-18948

An issue was found in Arista EOS. Specific malformed ARP packets can impact the software forwarding of VxLAN packets. This issue is found in Arista’s EOS VxLAN code, which can allow attackers to crash the VxlanSwFwd agent. This affects EOS 4.21.8M and below releases in the 4.21.x train, 4.22.3M a...

CVE-2019-18948

An issue was found in Arista EOS. Specific malformed ARP packets can impact the software forwarding of VxLAN packets. This issue is found in Arista’s EOS VxLAN code, which can allow attackers to crash the VxlanSwFwd agent. This affects EOS 4.21.8M and below releases in the 4.21.x train, 4.22.3M a...