Security Advisory 0071

1 year ago

## Security Advisory 0071 _._CSAF PDF

#### **Date:** January 11th, 2022

### Security Advisory 0071

The CVE-ID tracking this issue: CVE-2021-28500
CVSSv3.1 Base Score: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)

The CVE-ID tracking this issue: CVE-2021-28501
CVSSv3.1 Base Score: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)

The CVE-ID tracking this issue: CVE-2021-28506
CVSSv3.1 Base Score: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)

The CVE-ID tracking this issue: CVE-2021-28507
CVSSv3.1 Base Score: 5.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N)

### Description

This advisory documents the impact of several vulnerabilities related to OpenConfig transport protocols in Aristaâs EOS software. Affected software releases are listed below.

**CVE-2021-28500, CVE-2021-28501** – An issue has recently been discovered where the incorrect use of EOS’s AAA APIâs by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration.

**CVE-2021-28506** – Certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a factory reset of the device.

**CVE-2021-28507** – Under certain conditions, the service ACL configured for OpenConfig gNOI and OpenConfig RESTCONF might be bypassed, which results in the denied requests being forwarded to the agent.

**Acknowledgements**

Arista would like to acknowledge and thank Miles Sutcliffe @ for responsibly reporting CVE-2021-28500
CVE-2021-28501, CVE-2021-28506 and CVE-2021-28507 were found internally at Arista on Arista devices.

None of the vulnerabilities are known to be actively used maliciously in the field.

### Vulnerability Assessment

**Affected Software**

CVE-2021-28500

* 4.26.1F and below releases in the 4.26.x train
* 4.25.4M and below releases in the 4.25.x train
* 4.24.6M and below releases in the 4.24.x train
* 4.23.8M and below releases in the 4.23.x train
* 4.22.11M and below in 4.22.x train
* 4.21.14M and below in 4.21.x train
* All prior releases

CVE-2021-28501

* TerminAttr v1.16.1 and all prior releases

CVE-2021-28506

CVE-2021-28507

* 4.26.2F and below releases in the 4.26.x train
* 4.25.5.1M and below releases in the 4.25.5.x train
* 4.25.4M and below in the 4.25.4.x train
* All prior releases in 4.25.x train
* 4.24.7M and below releases in the 4.24.x train
* 4.23.9M and below releases in the 4.23.x train
* All releases in 4.22.x train
* All releases in 4.21.x train
* All prior releases

**Affected Platforms**

This is a platform-independent vulnerability and affects all systems running EOS with the versions identified above.

The following product versions and platforms are not affected by this vulnerability:

* Arista Wireless Access Points
* CloudVision WiFi, virtual appliance or physical appliance
* CloudVision WiFi cloud service delivery
* CloudVision Portal, virtual appliance or physical appliance
* CloudVision as-a-Service
* Arista 7130 Systems running MOS
* Arista Converged Cloud Fabric and DANZ Monitoring Fabric (Formerly Big Switch Nodes for BCF and BMF)
* Awake Security Platform

**Required Configuration for Exploitation**

**_Configuration vulnerable to CVE-2021-28500_**

OpenConfig gNMI/gNOI is enabled, or

management api gnmi
transport grpc default

OpenConfig RESTCONF is enabled

management api restconf
transport https default

and no password remote login authentication is disabled

no aaa authentication policy local allow-nopassword-remote-login

and a local user exists whose authentication is with nopassword.

username admin privilege 1 role network-admin nopassword

_**Configuration vulnerable to CVE-2021-28501 **_

TerminAttr gNMI is enabled

daemon TerminAttr
exec /usr/bin/TerminAttr …
no shutdown

and no password remote login authentication is disabled

no aaa authentication policy local allow-nopassword-remote-login

and a local user exists whose authentication is with nopassword.

username admin privilege 1 role network-admin nopassword

_**Configuration vulnerable to CVE-2021-28506 **_

OpenConfig gNMI/gNOI

management api gnmi
transport grpc default

_**Configuration vulnerable to CVE-2021-28507 **_

A service ACL is configured and

ip access-list standard oc-acl
10 permit host 10.1.1.1
20 permit host 172.16.1.1/24
30 deny any

gNMI/gNOI is configured with service ACL, or

management api gnmi
transport grpc default
ip access-group oc-acl

RESTCONF configured with service ACL.

management api restconf
transport https default
ip access-group oc-acl

**Notes**

_**Mutual TLS**_

If a mutual TLS certificate is configured for gNMI or TerminAttr, the server may not be affected by authentication vulnerabilities CVE-2021-28500, CVE-2021-28501 and CVE-2021-28506. This does not apply to RESTCONF.

OpenConfig gNMI is configured with SSL profile

management api gnmi
transport grpc default
ssl profile mtls-grpc-profile
management security
ssl profile mtls-grpc-profile
certificate target.crt key target.key
trust certificate ca.crt

TerminAttr is configured with SSL profile

daemon TerminAttr
exec /usr/bin/TerminAttr
-certfile /persist/secure/ssl/certs/target.crt
-keyfile /persist/secure/ssl/keys/target.key
-clientcafile /persist/secure/ssl/certs/ca.crt
no shutdown

### Symptoms

The following system logs at /var/log/messages may indicate vulnerability to CVE-2021-28500. When a gNMI Set is issued, the host should be recognized.

Nov 24 02:31:20 cd217 ConfigAgent: %SYS-5-CONFIG_SESSION_ENTERED: User admin entered configuration session session1068691224937 on GNMI (10.24.128.7:46054)
Nov 24 02:31:22 cd217 ConfigAgent: %SYS-5-CONFIG_SESSION_COMMIT_SUCCESS: User admin committed configuration session session1068691224937 successfully on GNMI (10.24.128.7:46054)
Nov 24 02:31:22 cd217 ConfigAgent: %SYS-5-CONFIG_SESSION_EXITED: User admin exited configuration session session1068691224937 on GNMI (10.24.128.7:46054)

The following symptoms may indicate vulnerability to this issue:

Check if the installed software is an affected version.
Terminattr

switch#show version detail | grep TerminAttr-core
TerminAttr-core v1.15.3 1

### Mitigation

The following configuration changes may be made in order to remedy the exploitation of the listed vulnerabilities.

**Disable affected agents:**

On the affected versions, all vulnerabilities can be mitigated by disabling OpenConfig gNMI/gNOI and OpenConfig RESTCONF and TerminAttr. If use of these agents is required, a hotfix employing a proxy service can be deployed.

Disable OpenConfig gNMI

management api gnmi
transport grpc default
shutdown

Disable OpenConfig RESTCONF

management api restconf
transport https default
shutdown

Disable OpenConfig TerminAttr

daemon TerminAttr
shutdown

**CVE-2021-28500 and CVE-2021-28501**

For local users whose authentication is with nopassword, enforce a password or remove the user.

Ensure that the following configuration does not exist where a local user is configured with nopassword.

username admin nopassword

Instead, a password can be enforced for the local user.

username admin secret 0 pass123

Please refer to the EOS user security manual for further information.

**CVE-2021-28506 and CVE-2021-28507**

No mitigation options available

For the final resolution, please refer to the resolution section which lists the details of the remediated software versions.

### Resolution

The vulnerabilities listed below, as identified by their CVE numbers, are being tracked by the following bugs:

**CVE-2021-28500** – BUG 601875
**CVE-2021-28501** – BUG 604880
**CVE-2021-28506** – BUG 606192
**CVE-2021-28507** – BUG 606248

The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.

CVE-2021-28500 has been fixed in the following releases:

* 4.26.2F and later releases in the 4.26.x train
* 4.25.5M and later releases in the 4.25.x train
* 4.25.4.1M and later releases in the 4.25.4.x train
* 4.24.7M and later releases in the 4.24.x train
* 4.23.9M and later releases in the 4.23.x train
* 4.22.12M and later releases in the 4.22.x train
* 4.21.15M and later releases in the 4.21.x train

CVE-2021-28501 has been fixed in the following releases:

* TerminAttr v1.16.2 and later releases

CVE-2021-28506 has been fixed in the following releases:

* 4.26.3M and later releases in the 4.26.x train
* 4.25.6M and later releases in the 4.25.x train
* 4.25.4.1M and later releases in the 4.25.4.x train
* 4.24.8M and later releases in the 4.24.x train

CVE-2021-28507 has been fixed in the following releases:

* 4.26.3M and later releases in the 4.26.x train
* 4.25.6M and later releases in the 4.25.x train
* 4.25.4.1M and later releases in the 4.25.4.x train
* 4.24.8M and later releases in the 4.24.x train
* 4.23.10M and later releases in the 4.23.x train

For immediate remediation until EOS can be upgraded, the following hotfix is available.

**Hotfix**

To mitigate CVE-2021-28500, CVE-2021-28501, CVE-2021-28506 and CVE-2021-28507 with the continued use of the affected agents, a hotfix employing a proxy service can be deployed. The proxy is configured behind the gNMI/gNOI or RESTCONF server.

OpenConfigProxy is a universal proxy for the OpenConfig gNMI/gNOI server, OpenConfig RESTCONF server or TerminAttr gNMI server. The proxy performs:

* IP ACL check
* Authentication
* Authorization (for gNMI/gNOI only, disabled by default)

Requests are forwarded to the OpenConfig gNMI/gNOI server or RESTCONF server or TerminAttr gNMI server. Responses are sent to the collector from the gNMI/gNOI server or RESTCONF server via the proxy.

Hotfix Notes:

* The hotfix employing a proxy service is version agnostic (i.e., the proxy can be installed on any affected version).
* The hotfix employing a proxy service does not require a restart of the OpenConfig/Octa agent. Only OpenConfig gNMI or RESTCONF configuration changes are required.
* The hotfix employing a proxy service installation is hitless and a reload of the switch is not required for the hotfix to take effect.

TerminAttr Note: For TerminAttr, it is recommended to update to TerminAttr v1.16.3 or above as its agent can be updated independently of the EOS version.

The following hotfix is available to remedy all CVEâs listed in this Security Advisory:

**32 bit platform:**
**Version: 1.0**
**URL: **OpenConfigProxy.i386.swix
**SWIX hash:** (SHA-512)
fef14efde0ba282ab90664ffbd5ff6d37172062ea5f97fc44b457d0b0922d4c7bc5780a0d0f89dbe540fd38e3daa875b46b5f7d57edb3973212d8b2f7f1ec7d6

**64 bit platform:**
**Version:** 1.0
**URL:** **OpenConfigProxy.x86_64.swix**
**SWIX hash:** (SHA-512)
db4488cb6328fb93bdcbcc11edfff95be92755b5acc263d0ecff70c879e52fe51471eb1783acb9dc53a9115f575dc7146b8984c26d4282806b37b0dc5ded18c2

For detailed information on installation and configuration of the OpenConfigProxy please refer to the documentation here

### **For More Information**

If you require further assistance, or if you have any further questions regarding this security notice, please contact the Arista Networks Technical Assistance Center (TAC) by one of the following methods:

#### **Open a Service Request: **

Please visit Customer Support for up to date information on how to open a service request via email or telephone.Read More