CVE-2018-8119 - A spoofing vulnerability exists when the Azure IoT Device Provisioning AMQP Transport library improperly validates certificates over the AMQP protocol, aka "Azure IoT SDK Spoofing Vulnerability." This affects C# SDK, C SDK, Java SDK

Back Back to CVE browser

MEDIUM

A spoofing vulnerability exists when the Azure IoT Device Provisioning AMQP Transport library improperly validates certificates over the AMQP protocol, aka "Azure IoT SDK Spoofing Vulnerability." This affects C# SDK, C SDK, Java SDK

Published May 9, 2018

5.6

MEDIUM

CVSS 3.0

EPSS 1.18%

Description

A spoofing vulnerability exists when the Azure IoT Device Provisioning AMQP Transport library improperly validates certificates over the AMQP protocol, aka "Azure IoT SDK Spoofing Vulnerability." This affects C# SDK, C SDK, Java SDK.

Affected products

Vendor Microsoft Product C SDK Default
n/a
- Version
  Azure IoT
  Status
  affected
  Constraints
  -
Vendor Microsoft Product C# SDK Default
n/a
- Version
  Azure IoT
  Status
  affected
  Constraints
  -
Vendor Microsoft Product Java SDK Default
n/a
- Version
  Azure IoT
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Microsoft

C SDK

n/a

Version	Status	Constraints
Azure IoT	affected	-

Microsoft

C# SDK

n/a

Version	Status	Constraints
Azure IoT	affected	-

Microsoft

Java SDK

n/a

Version	Status	Constraints
Azure IoT	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-295

Improper Certificate Validation

References (3)

http://www.securityfocus.com/bid/104070
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8119
x_refsource_CONFIRMPatchVendor Advisory
https://tools.cisco.com/security/center/viewAlert.x?alertId=57754&vs_f=Alert%20RSS&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Microsoft%20Azure%20IoT%20SDK%20AMQP%20Transport%20Library%20Spoofing%20Vulnerability&vs_k=1
Third Party Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/104070		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8119		x_refsource_CONFIRMPatchVendor Advisory
https://tools.cisco.com/security/center/viewAlert.x?alertId=57754&vs_f=Alert%20RSS&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Microsoft%20Azure%20IoT%20SDK%20AMQP%20Transport%20Library%20Spoofing%20Vulnerability&vs_k=1		Third Party Advisory