PT-2019-13850 · Arista · Eos

Publicado 2019-10-09 · Atualizado 2019-10-21 · CVE-2019-14810

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions EOS versions 4.22.1F and earlier releases EOS versions 4.21.0F through 4.21.2.3F EOS versions 4.21.3F through 4.21.7.1M EOS versions 4.20.14M and earlier releases EOS versions 4.19.12M and earlier releases

Description A vulnerability has been found in the implementation of the Label Distribution Protocol (LDP) protocol in EOS. Under race conditions, the LDP agent can establish an LDP session with a malicious peer, potentially allowing the possibility of a Denial of Service (DoS) attack on route updates and in turn potentially leading to an Out of Memory (OOM) condition that is disruptive to traffic forwarding. There is no evidence of this vulnerability being exploited as of the date of this update.

Recommendations For EOS versions 4.22.1F and earlier releases, update to a version later than 4.22.1F. For EOS versions 4.21.0F through 4.21.2.3F, update to a version later than 4.21.2.3F. For EOS versions 4.21.3F through 4.21.7.1M, update to a version later than 4.21.7.1M. For EOS versions 4.20.14M and earlier releases, update to a version later than 4.20.14M. For EOS versions 4.19.12M and earlier releases, update to a version later than 4.19.12M.

Correção

DoS

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2019-14810

Produtos afetados

Eos

Referências · 4

• https://arista.com/en/support/advisories-notices · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-14810 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-14810 · Nota de Segurança
• https://arista.com/en/support/advisories-notices/security-advisories/8321-security-advisory-42 · Aviso do Fabricante