Security Advisory 0033

Security Advisory 0033 PDF Date: April 5th, 2018 Version: 1.0 Revision| Date| Changes ---|---|--- 1.0 | April 5th, 2018 | Initial Release Affected Platforms: All EOS platforms Affected Software Version: EOS-4.20.1F release. The CVE-ID tracking this issue is CVE-2018-5254 CVSS v3: 5.0...

Security Advisory 0032

Security Advisory 0032 PDF Date: March 1st, 2018 Version: 1.0 Revision| Date| Changes ---|---|--- 1.0 | March 1st, 2018 | Initial Release Affected Platforms: All EOS platforms Affected Software Version: This issue was introduced in EOS-4.19.0F release. The CVE-ID tracking this issue is...

Security Advisory 0031

Security Advisory 0031 PDF Date: January 3rd, 2018 Version: 1.0 Revision| Date| Changes ---|---|--- 1.0 | January 3rd, 2018 | Initial Release 1.1 | January 8th, 2018 | Updated description with expanded analysis Arista Products vulnerability report for the following CVEs: Spectre CVE-2017-5753:...

Security Advisory 0030

Security Advisory 0030 PDF Date: October 2nd, 2017 Version: 1.0 Revision| Date| Changes ---|---|--- 1.0 | October 2nd, 2017 | Public release 1.1 | October 3rd, 2017 | Updates to clarify impact and add mitigation 1.2 | October 6th, 2017 | Updates to the affected software release table 1.3 | Octobe...

Security Advisory 0029

Security Advisory 0029 PDF Date: May 15th, 2017 Version: 1.0 Revision| Date| Changes ---|---|--- 1.0 | May 15th, 2017 | Initial release Affected Platforms: All EOS platforms Affected Software Version: All EOS releases prior to 4.18.1F. The list of affected releases is documented in Table-2. The...

Security Advisory 0028

Security Advisory 0028 PDF Date: May 15th, 2017 Version: 1.0 Revision| Date| Changes ---|---|--- 1.0 | May 15th, 2017 | Initial Release Arista Products vulnerability report for CVE-2016-7117 On October 2016, information was released about a security advisory for a vulnerability in the sysrecvmmsg...

Security Advisory 0027

Security Advisory 0027 PDF Date: December 1st, 2016 Version: 1.1 Revision| Date| Changes ---|---|--- 1.0 | December 1st, 2016 | Initial Release 1.1 | December 6th, 2016 | Impact section of this advisory is updated Affected Platforms: CloudVision Portal CVP only. Affected Software Version: All...

Security Advisory 0026

Security Advisory 0026 PDF Date: October 21st, 2016 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | October 21st, 2016 | Initial release Arista Products vulnerability report for CVE-2016-5195 On October 21st 2016, information was released about a security advisory for a race condition...

Security Advisory 0025

Security Advisory 0025 PDF Date: October 17th, 2016 Version: 1.1 Revision | Date | Changes ---|---|--- 1.0 | October 17th, 2016 | Initial Release 1.1 | October 18th, 2016 | Affected platforms section is expanded Affected Platforms:DCS-7050 series only - 7050S, 7050T, 7050Q platforms 7050X series ...

Security Advisory 0024

Security Advisory 0024 PDF Date: October 4th, 2016 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | October 4th, 2016 | Initial release Arista Products vulnerability report for security vulnerabilities announcement from the OpenSSL project on September 22nd, 2016 Product: EOS and...

Security Advisory 0023

Security Advisory 0023 PDF Date: August 15th, 2016 Version: 1.0 Revision| Date| Changes ---|---|--- 1.0 | August 15th, 2016 | Initial release 1.1 | September 15th, 2016 | Updated to include fixed software versions Arista Products vulnerability report for security vulnerability CVE-2016-5696 that...

Security Advisory 0022

Security Advisory 0022 PDF Date: June 28th, 2016 Version: 1.1 Revision| Date| Changes ---|---|--- 1.0 | June 15th, 2016 | Initial release 1.1 | June 28th, 2016 | Updated to remove a part of the mitigation section that involved ipv6 ACLs with hop-limit. This section was removed in order to avoid a...

Security Advisory 0021

Security Advisory 0021 PDF Date: June 13th, 2016 Version: 1.0 Revision| Date| Changes ---|---|--- 1.0 | June 13th, 2016 | Initial release Arista Products vulnerability report for security vulnerability announcement from NGINX on May 31st, 2016 It was announced by NGINX on May 31, 2016 that there ...

Security Advisory 0020

Security Advisory 0020 PDF Date: May 6th, 2016 Version: 1.2 Revision| Date| Changes ---|---|--- 1.0 | May 6th, 2016 | Initial release 1.1 | May 12th, 2016 | Updated to include assessment for CVX and CVP. Change in vulnerability status for CVE-2016-2107. 1.2 | May 20th, 2016 | Updated to include...

Security Advisory 0019

Security Advisory 0019 PDF Date: April 25th, 2018 Version: 1.1 Revision| Date| Changes ---|---|--- 1.0 | May 3rd, 2016 | Initial release 1.1 | April 25th, 2018 | Updated vulnerability information for CVE-2016-1549 Arista Products vulnerability report for security vulnerabilities announcement from...

Security Advisory 0018

Security Advisory 0018 PDF Date: March 1st, 2016 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | March 1st, 2016 | Initial release. Issue under investigation. 1.1 | March 7th, 2016 | Updated to include assessment Arista Products vulnerability report for security vulnerabilities released ...

Security Advisory 0017

Security Advisory 0017 PDF Date: October 31st, 2017 Version: 1.6 Revision | Date | Changes ---|---|--- 1.0 | February 16th, 2016 | Initial release 1.1 | February 19th, 2016 | Updates include assessment and mitigation 1.2 | February 25th, 2016 | Updates include options for mitigation and protectio...

Security Advisory 0015

Security Advisory 0015 PDF Date: November 18th, 2015 Revision | Date | Changes ---|---|--- 1.0 | November 18th, 2015 | Public release 1.1 | November 18th, 2015 | Updated to include CVE number and bug ID Arista EOS Remote Privilege Escalation Vulnerability - CVE-2015-8236 This advisory is to...

Security Advisory 0016

Security Advisory 0016 PDF Date: November 4th 2015 Revision| Date| Changes ---|---|--- 1.0 | November 5th, 2015 | Initial release Arista Products vulnerability report for security vulnerabilities released for NTP in October, 2015 The NTP project released the following set of low and medium severi...

Security Advisory 0014

Security Advisory 0014 PDF Date: September 23rd, 2015 Revision | Date | Changes ---|---|--- 1.0 | September 23rd, 2015 | Initial release 1.1 | August 11th, 2023 | Updated discovered EOS version 4.12.1 Arista Products vulnerability report for security released for QEMU between August 27th and...

Security Advisory 0013

Security Advisory 0013 PDF Date: September 4th 2015 Revision| Date| Changes ---|---|--- 1.0 | September 4th, 2015 | Initial release Arista Products vulnerability report for security updates released for QEMU on August 23rd, 2015. In August 2015 the Fedora project issued an update for QEMU that...

Security Advisory 0012

Security Advisory 0012 PDF Date: August 20th 2015 Revision | Date | Changes ---|---|--- 1.0 | August 20th, 2015 | Initial release 1.1 | August 24th, 2015 | Updated with patch details. 1.2 | November 22nd, 2017 | Updated with the fixed updated EOS releases Arista 7000 Series Products and Arista EO...

Security Advisory 0011

Security Advisory 0011 PDF Date: June 17th 2015 Revision| Date| Changes ---|---|--- 1.0 | June 17th, 2015 | Initial release 1.1 | November 4th, 2015 | Updated to reflect versions with the fix for tracked bugs. Change in vulnerability status for CVE-2014-8176 Arista Products Vulnerability report f...

Security Advisory 0010

Security Advisory 0010 PDF Date: May 14th 2015 Revision| Date| Changes ---|---|--- 1.0 | May 14th, 2015 | Initial release 1.1 | November 22nd, 2017 | Resolution section updated to reflect the correct BUGID Arista 7000 Series Products and Arista EOS are vulnerable to CVE-2015-3456. On May 13th, 20...

Security Advisory 0009

Security Advisory 0009 PDF Date: January 28th 2015 Revision| Date| Changes ---|---|--- 1.0 | January 28th 2015 | Initial release Arista 7000 Series Products and Arista EOS are not remotely exploitable by CVE-2015-0235 On Jan 27th, information was released about a security advisory for the glibc...

Security Advisory 0008

Security Advisory 0008 PDF Date: January 9th 2015 Revision| Date| Changes ---|---|--- 1.0 | January 9th 2015 | Initial release Arista 7000 Series Products and Arista EOS are not vulnerable to NTP CVE-2014-9293, CVE-2014-9294, CVE-2014-9295, and CVE-2014-9296. In December 2014, the Network Time...

Security Advisory 0007

Security Advisory 0007 PDF Date: October 20th 2014 Revision | Date | Changes ---|---|--- 1.0 | October 20th 2014 | Initial release SSLv3 is vulnerable to potential man in the middle attacks CVE-2014-3566 On October 14th, Arista became aware of a vulnerability in the Secure Sockets Layer version 3...

Security Advisory 0006

Security Advisory 0006 PDF Date: September 29th 2014 Revision | Date | Changes ---|---|--- 1.0 | September 29th 2014 | Initial release 1.1 | September 30th 2014 | Additional details on maintenance releases 1.2 | October 29th 2014 | Additional details on fixed releases 1.3 | November 4th 2014 |...

Security Advisory 0005

Security Advisory 0005 PDF Date: 6/9/2014 Revision | Date | Changes ---|---|--- 1.0 | June 9th 2014 | Initial release 1.1 | June 12th 2014 | Addition of patch installation details 1.2 | July 6th 2015 | Updated patch file Open SSL clients running on Arista EOS vulnerable to SSL/TLS MITM...

Security Advisory 0004

Security Advisory 0004 PDF Date: 4/9/2014 Arista 7000 Series Products and Arista EOS Not Vulnerable to OpenSSL CVE-2014-0160 On April 7th, the OpenSSL Project issued a security advisory for a TLS heartbeat read overrun vulnerability. This vulnerability allows attackers to access the memory of web...

Security Advisory 0003

Security Advisory 0003 PDF Date: 2/14/2014 Affected Software Version: EOS-4.13.0F through EOS-4.13.1F. Note: Only publicly accessible systems are vulnerable to this attack. Bug 77553: ntpd monlist vulnerability Impact: NTP provides a monitoring service that allows administrators to query an ntpd...

Security Advisory 0002

Security Advisory 0002 PDF Date: 9/12/2012 Affected Software Version: EOS-4.8.0 through EOS-4.8.7, EOS-4.9.0 through EOS-4.9.5, EOS-4.10, EOS-4.10.1 Note: You must have IPv6 addresses configured on your system for this to affect you. Bug 39915: Null pointer dereference in nfconntrackipv6 Impact: ...