Microsoft Azure IoT SDK CVE-2018-8479 Spoofing Vulnerability

2018-09-11T00:00:00
ID SMNTC-105323
Type symantec
Reporter Symantec Security Response
Modified 2018-09-11T00:00:00

Description

Description

Microsoft Azure IoT SDK is prone to a security vulnerability that may allow attackers to conduct spoofing attacks. Successful exploits may allow attackers to perform man-in-the-middle attacks or impersonate server, which will aid in further attacks.

Technologies Affected

  • Microsoft C SDK for Azure IoT

Recommendations

Deploy network intrusion detection systems to monitor network traffic for malicious activity.
Deploy NIDS to monitor network traffic for signs of anomalous or suspicious activity. This includes but is not limited to unexplained incoming and outgoing traffic. This may indicate exploit attempts or activity that results from successful exploits.

Do not accept communications that originate from unknown or untrusted sources.
execute commands to mount SMB shares. Never follow directions from untrusted sources. Modify default configuration files to disable any unwanted behavior

Updates are available. Please see the references or vendor advisory for more information.