Lucene search

MicrosoftCVE-2018-8531

HistoryOct 10, 2018 - 1:29 p.m.

CVE-2018-8531

2018-10-1013:29:06

CWE-787

microsoft

web.nvd.nist.gov

vulnerability

remote code execution

azure iot

mqtt protocol

memory corruption

nvd

cve-2018-8531

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.146

Percentile

95.9%

JSON

A remote code execution vulnerability exists in the way that Azure IoT Hub Device Client SDK using MQTT protocol accesses objects in memory, aka “Azure IoT Device Client SDK Memory Corruption Vulnerability.” This affects Hub Device Client SDK, Azure IoT Edge.

Affected configurations

Nvd

Vulners

Node

microsoftazure_internet_of_things_edgeMatch-

Node

microsoftcsharp_software_development_kitazure_internet_of_things

VendorProductVersionCPE
microsoftazure_internet_of_things_edge-cpe:2.3:a:microsoft:azure_internet_of_things_edge:-:*:*:*:*:*:*:*
microsoftcsharp_software_development_kit*cpe:2.3:a:microsoft:csharp_software_development_kit:*:*:*:*:*:azure_internet_of_things:*:*

Vendor	Product	Version	CPE
microsoft	azure_internet_of_things_edge	-	cpe:2.3:a:microsoft:azure_internet_of_things_edge:-:::::::*
microsoft	csharp_software_development_kit	*	cpe:2.3:a:microsoft:csharp_software_development_kit::::::azure_internet_of_things::*

CNA Affected

[
  {
    "product": "Hub Device Client SDK",
    "vendor": "Microsoft",
    "versions": [
      {
        "status": "affected",
        "version": "Azure IoT"
      }
    ]
  },
  {
    "product": "Azure IoT Edge",
    "vendor": "Microsoft",
    "versions": [
      {
        "status": "affected",
        "version": "Azure IoT Edge"
      }
    ]
  }
]

References

www.securityfocus.com/bid/105472

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8531

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.146

Percentile

95.9%

JSON

Related for CVE-2018-8531