How to remediate – Arista Networks EOS Multiple Vulnerabilities (SA0019)

1. Introduction

Arista Networks EOS Multiple Vulnerabilities (SA0019) affects versions of Arista’s network operating system. These vulnerabilities relate to flaws in the Network Time Protocol (NTP) implementation, which could allow attackers to spoof content, cause denial-of-service conditions, or modify a victim’s clock. This impacts networks using EOS devices for time synchronization. A successful exploit could compromise confidentiality, integrity and availability of network services.

2. Technical Explanation

The vulnerabilities stem from several issues within the NTP implementation in Arista EOS. These include insecure handling of packets with zero origin timestamps, crafted Crypto NAK packets, spoofed source addresses, saturation of ephemeral associations, and flawed message authentication. An unauthenticated remote attacker can exploit these flaws to disrupt services or gain unauthorized access.

• Root cause: The NTP implementation does not adequately validate incoming packets, allowing for manipulation of time data and client associations.
• Exploit mechanism: Attackers can send crafted NTP packets to the vulnerable EOS device, exploiting weaknesses in the receive() function or other packet handling routines. For example, sending a packet with an origin timestamp of zero could bypass security checks.
• Scope: Arista Networks EOS is affected. Specific versions are impacted; contact the vendor for details.

3. Detection and Assessment

To confirm vulnerability, check the installed EOS version. Scanning tools may also identify these vulnerabilities based on known signatures.

• Quick checks: Use the command show version to display the EOS software version running on the device.
• Scanning: Nessus plugin ID dabe6203 can detect these vulnerabilities. This is an example only, and other scanners may also provide detection capabilities.
• Logs and evidence: Examine system logs for NTP-related errors or anomalies. Specific log files will vary depending on EOS configuration.

show version

4. Solution / Remediation Steps

The recommended solution is to contact Arista Networks for a fixed version of EOS and apply the appropriate patch.

4.1 Preparation

• Stopping services may be required during the update process; consult Arista documentation. A roll back plan is to restore from backup or snapshot.
• A change window should be scheduled, and approval obtained from relevant stakeholders.

4.2 Implementation

1. Step 1: Contact Arista Networks support to obtain the latest EOS software version containing fixes for SA0019.
2. Step 2: Download the updated EOS image file.
3. Step 3: Follow Arista’s documented procedures to upgrade the EOS software on the affected device. This typically involves booting from a new image or using an update command.

4.3 Config or Code Example

Before

show version

After

show version

4.4 Security Practices Relevant to This Vulnerability

• Patch cadence: Regularly apply security patches and updates from Arista Networks to address known vulnerabilities in EOS.

4.5 Automation (Optional)

Automation is not directly applicable for this vulnerability, as it requires a full software upgrade managed through vendor-specific tools.

5. Verification / Validation

Verify the fix by confirming that the EOS version has been updated to a patched release. Re-run detection methods to ensure the vulnerabilities are no longer present.

• Post-fix check: Use show version and confirm the output displays the new, patched EOS software version.
• Re-test: Run the Nessus plugin ID dabe6203 again; it should no longer report the vulnerabilities.
• Monitoring: Monitor system logs for NTP-related errors or anomalies that may indicate a regression.

show version

6. Preventive Measures and Monitoring

Regularly update security baselines to include patched EOS versions. Implement a robust patch management process.

• Baselines: Update your network device baseline configuration to require the latest EOS software releases.

7. Risks, Side Effects, and Roll Back

Upgrading EOS carries risks of service disruption if the upgrade fails or introduces compatibility issues. A roll back plan is essential.

• Risk or side effect 1: Service interruption during the upgrade process. Mitigation: Schedule upgrades during maintenance windows and have a rollback plan ready.

8. References and Resources

• Vendor advisory or bulletin: http://www.nessus.org/u?dabe6203
• NVD or CVE entry: CVE-2015-8138, CVE-2016-1547, CVE-2016-1548, CVE-2016-1549, CVE-2016-1550