CVE-2018-8119

A spoofing vulnerability exists when the Azure IoT Device Provisioning AMQP Transport library improperly validates certificates over the AMQP protocol, aka Azure IoT SDK Spoofing Vulnerability. This affects C# SDK, C SDK, Java SDK.

Weakness

The product does not validate, or incorrectly validates, a certificate.

Affected Software

Potential Mitigations

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/459.html
• https://cwe.mitre.org/data/definitions/475.html

References

• http://www.securityfocus.com/bid/104070
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8119
• https://tools.cisco.com/security/center/viewAlert.x?alertId=57754\u0026vs_f=Alert%20RSS\u0026vs_cat=Security%20Intelligence\u0026vs_type=RSS\u0026vs_p=Microsoft%20Azure%20IoT%20SDK%20AMQP%20Transport%20Library%20Spoofing%20Vulnerability\u0026vs_k=1
• http://www.securityfocus.com/bid/104070
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8119