#VU17651 Cryptographic issues in Java SDK for Azure IoT


Published: 2019-02-13

Vulnerability identifier: #VU17651

Vulnerability risk: Low

CVSSv3.1: 4.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-0729

CWE-ID: CWE-310

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
Java SDK for Azure IoT
Universal components / Libraries / Software for developers

Vendor: Microsoft

Description

The vulnerability allows a remote attacker to elevate privileges on the device.

The vulnerability exists due to Azure IoT Java SDK generates predictable symmetric keys for encryption. An attacker can derive the keys from the way they are generated and use them to access a user's IoT hub.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Java SDK for Azure IoT: All versions

External links
http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0729

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Multiple vulnerabilities in Azure IoT Java SDK