Security Advisory 0038 .CSAF
Date: September 13th, 2018
|1.0||September 13th, 2018||Initial Release|
The CVE-ID tracking this issue is CVE-2018-14008
CVSS v3: 6.5/10 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
This advisory is to document a security vulnerability that affects EOS. The affected feature is 802.1x authentication, and by extension MACSec when dynamic keys are used. The vulnerability allows for crashing the Dot1x agent via a crafted packet sent from the data port which could result in a denial of service attack at the data plane preventing other users from successfully authenticating with the device. This vulnerability was identified internally by Arista Networks and Arista has not received evidence of this being exploited, as of the date of this update.
Bug ID: 275350
Affected EOS versions:
|4.21||4.20||4.19||4.18||4.17||4.16||All older release trains|
|All release trains older than 4.15|
802.1x is a platform independent feature. All platforms are affected.
The Dot1x agent crash would be a symptom when receiving malicious packets from a supplicant. Relevant observation would be failing for 802.1x authentication, and by extension MACsec. The impact to MACsec would be only when dynamic keys are used ("key source dot1x" should appear in the macsec profile for this vulnerability to affect MACsec).
This vulnerability can be exploited only if the 802.1x feature has been configured.
It is recommended to install this patch on affected versions of EOS to safeguard against this vulnerability.
Patch file download URL: SecurityAdvisory0038Hotfix.swix
sha256sum is: fa9687080df6dd5602f835abf8f34660b66c651711d17310b89eadb5807f5c3f
sha512sum is: 3f764e58f7b090f5ad70d51e080298f753907578f2a41f998a2dab18304fffc6d329a600dc8b32e3dee1ebf2ad202116f663c6909c2c690581ca393746b4247e
- The patch installation is hitless and a reload of the switch is not required for the patch to take effect
- This hotfix is EOS dependent and can be patched with the following versions:
Instructions to install the patch:
- Download the patch file and copy the file to the extension partition of the switch using one of the supported file transfer protocols:
switch#copy scp://10.10.0.1/SecurityAdvisory0038Hotfix.swix extension: switch#verify /sha512 extension:SecurityAdvisory0038Hotfix.swix verify /sha512 (extension:SecurityAdvisory0038Hotfix.swix) = 3f764e58f7b090f5ad70d51e080298f753907578f2a41f998a2dab18304fffc6d329a600dc8b32e3dee1ebf2ad202116f663c6909c2c690581ca393746b4247e
- Verify that the checksum value returned by the above command matches the provided checksum for the file
- Install the patch using the extension command. The patch takes effect immediately at the time of installation.
- Verify that the patch is installed using the following commands:
switch#show extensions Name Version/Release Status Extension ------------------------------------ -------------------- ----------- --------- SecurityAdvisory0038Hotfix.swix 1.0.0/eng A, I 1
- Make the patch persistent across reloads. This ensures that the patch is installed as part of the boot-sequence. The patch will not install on EOS versions with the security fix.
switch#copy installed-extensions boot-extensions switch#show boot-extensions SecurityAdvisory0038Hotfix.swix
- For dual-supervisor systems, ensure the patch is installed on both supervisors by following the steps documented above. Copy the patch to flash of both the supervisors and follow the procedure outlined above.
For additional guidance on the installation of extensions, refer to the Arista Configuration Guide: https://www.arista.com/en/um-eos
Bug 275350 tracks this vulnerability for EOS. The fix for this issue will be available starting in the following EOS releases:
- 4.20.9M (available as of the date of advisory posting)
- 4.19.10M (available as of the date of advisory posting)
Please install the provided hotfix as a mitigation until the remediated versions are available.
For More Information:
If you require further assistance, or if you have any further questions regarding this security notice, please contact the Arista Networks Technical Assistance Center (TAC) by one of the following methods:
Open a Service Request:
By telephone: 408-547-5502