security-advisory-0080

This advisory documents the impact of 4 publicly disclosed vulnerabilities within Ethernet encapsulation protocols on Arista products. These issues affect multiple networking vendors and the coordination of this disclosure has been handled by IEEE. The issues involve how L2 network security controls can be bypassed using VLAN 0 stacking or 802.3 LLC headers with invalid length. An attacker can send crafted packets through vulnerable devices to cause Denial-of-Service (DoS) or to perform a Man-in-the-Middle (MitM) attack against L2 reachable hosts in the network. As of the time of this publication, Arista is not aware of any malicious uses of this issue in customer networks.