CVE-2018-5255

The Mlag agent in Arista EOS 4.19 before 4.19.4M and 4.20 before 4.20.2F allows remote attackers to cause a denial of service agent restart via crafted UDP packets...

CVE-2018-5255

The Mlag agent in Arista EOS 4.19 before 4.19.4M and 4.20 before 4.20.2F allows remote attackers to cause a denial of service agent restart via crafted UDP packets...

Code injection

The Mlag agent in Arista EOS 4.19 before 4.19.4M and 4.20 before 4.20.2F allows remote attackers to cause a denial of service agent restart via crafted UDP packets...

CVE-2018-5255

The Mlag agent in Arista EOS 4.19 before 4.19.4M and 4.20 before 4.20.2F allows remote attackers to cause a denial of service agent restart via crafted UDP packets...

CVE-2018-5255

The CVE affects Arista EOS Mlag agent: in EOS 4.19 before 4.19.4M and 4.20 before 4.20.2F, remote attackers can trigger a DoS by sending crafted UDP packets, restarting the Mlag agent. A fix is available: EOS 4.19.4M or 4.20.2F or later, via patches (CVE-2018-5255 hotfixes CVE-2018-5255-4-19-hotf...

Security Advisory 0032

Security Advisory 0032 PDF Date: March 1st, 2018 Version: 1.0 Revision| Date| Changes ---|---|--- 1.0 | March 1st, 2018 | Initial Release Affected Platforms: All EOS platforms Affected Software Version: This issue was introduced in EOS-4.19.0F release. The CVE-ID tracking this issue is...

Arista Networks EOS libresolv Overflow RCE (SA0017)

The version of Arista Networks EOS running on the remote device is affected by multiple stack-based buffer overflow conditions in the GNU libresolv library, specifically within the senddg and sendvc functions, when handling DNS responses that trigger a call to the getaddrinfo function with the...

Arista Networks EOS ASN.1 Encoder RCE (SA0020)

The version of Arista Networks EOS running on the remote device is affected by a remote code execution vulnerability in the ASN.1 encoder due to an underflow condition that occurs when attempting to encode the value zero represented as a negative integer. An unauthenticated, remote attacker can...

Arista Networks EOS ngx_chain_to_iovec NULL Pointer Deference DoS (SA0021)

The version of Arista Networks EOS running on the remote device is affected by a denial of service vulnerability in NGINX due to a NULL pointer dereference flaw in the ngxchaintoiovec function within file os/unix/ngxfiles.c when handling specially crafted requests. An unauthenticated, remote...

Arista Networks EOS tcp_input Challenge ACKs Shared Counter Disclosure (SA0023)

The version of Arista Networks EOS running on the remote device is affected by a flaw in the Linux kernel implementation within file net/ipv4/tcpinput.c due to a failure to properly determine the rate of challenge ACK segments. An unauthenticated, remote attacker can exploit this issue to access...

Arista Networks EOS Multiple Vulnerabilities (SA0024) (SWEET32)

The version of Arista Networks EOS running on the remote device is affected by multiple vulnerabilities in the included OpenSSL library : - An information disclosure vulnerability exists in the dsasignsetup function in dsaossl.c due to a failure to properly ensure the use of constant-time...

Arista Networks EOS 4.17 Multiple Vulnerabilities (SA0024) (SWEET32)

The version of Arista Networks EOS running on the remote device is affected by multiple vulnerabilities in the included OpenSSL library : - An information disclosure vulnerability exists in the dsasignsetup function in dsaossl.c due to a failure to properly ensure the use of constant-time...

Arista Networks EOS MPBGP Denial of Service (SA0029)

The version of Arista Networks EOS running on the remote device is affected by a potential denial of service vulnerability as a result of improper processing of malformed MPBGP updates. TRUSTED...

Arista Networks EOS Multiple Vulnerabilities (SA0019)

The version of Arista Networks EOS running on the remote device is affected by multiple vulnerabilities : - A flaw exists in NTP in the receive function within file ntpd/ntpproto.c that allows packets with an origin timestamp of zero to bypass security checks. An unauthenticated, remote attacker...

Arista Networks EOS Multiple Vulnerabilities (SA0018) (DROWN)

The version of Arista Networks EOS running on the remote device is affected by multiple vulnerabilities in the included OpenSSL library : - A cipher algorithm downgrade vulnerability exists due to a flaw that is triggered when handling cipher negotiation. A remote attacker can exploit this to...

Arista Networks EOS Control Plane Packet Handling DoS (SA0025)

The version of Arista Networks EOS running on the remote device is affected by a denial of service vulnerability due to an unspecified flaw when handling certain packets sent to the control plane. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to cause the...

Security Advisory 0030

Security Advisory 0030 PDF Date: October 2nd, 2017 Version: 1.0 Revision| Date| Changes ---|---|--- 1.0 | October 2nd, 2017 | Public release 1.1 | October 3rd, 2017 | Updates to clarify impact and add mitigation 1.2 | October 6th, 2017 | Updates to the affected software release table 1.3 | Octobe...

Integer Overflow Vulnerability in libmtp 'ptp_unpack_EOS_CustomFuncEx' Function

libmtp is an LGPL library for the Media Transport Protocol. An integer overflow vulnerability exists in the 'ptpunpackEOSCustomFuncEx' function of the ptp-pack.c file in libmtp versions 1.1.12 and earlier. A remote attacker could exploit this vulnerability by plugging a mobile device into a PC vi...

Arista EOS Compliance Checks

Binary data aristacompliancecheck.nbin...

Arista EOS DoS Vulnerability (Security Advisory 0025)

Arista EOS on DCS-7050 series is prone to a denial of service vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...