The azure-c-shared-utility is a C library for AMQP/MQTT communication to Azure Cloud Services. This library may be used by the Azure IoT C SDK for communication between IoT Hub and IoT Hub devices. An attacker can cause an integer wraparound or under-allocation or heap buffer overflow due to vulnerabilities in parameter checking mechanism, by exploiting the buffer length parameter in Azure C SDK, which may lead to remote code execution. Requirements for RCE are 1. Compromised Azure account allowing malformed payloads to be sent to the device via IoT Hub service, 2. By passing IoT hub service max message payload limit of 128KB, and 3. Ability to overwrite code space with remote code. Fixed in commit https://github.com/Azure/azure-c-shared-utility/commit/1129147c38ac02ad974c4c701a1e01b2141b9fe2.

The version of azure-iot-sdk-c installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-29195 advisory.

  - The azure-c-shared-utility is a C library for AMQP/MQTT communication to Azure Cloud Services. This     library May be used by the Azure IoT C SDK for communication between IoT Hub and IoT Hub devices. An     attacker can cause an integer wraparound or under-allocation or heap buffer overflow due to     vulnerabilities in parameter checking mechanism, by exploiting the buffer length parameter in Azure C SDK,     which May lead to remote code execution. Requirements for RCE are 1. Compromised Azure account allowing     malformed payloads to be sent to the device via IoT Hub service, 2. By passing IoT hub service max message     payload limit of 128KB, and 3. Ability to overwrite code space with remote code. Fixed in commit     https://github.com/Azure/azure-c-shared-utility/commit/1129147c38ac02ad974c4c701a1e01b2141b9fe2.
    (CVE-2024-29195)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of azure-iot-sdk-c installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-29195 advisory.

  - The azure-c-shared-utility is a C library for AMQP/MQTT communication to Azure Cloud Services. This     library May be used by the Azure IoT C SDK for communication between IoT Hub and IoT Hub devices. An     attacker can cause an integer wraparound or under-allocation or heap buffer overflow due to     vulnerabilities in parameter checking mechanism, by exploiting the buffer length parameter in Azure C SDK,     which May lead to remote code execution. Requirements for RCE are 1. Compromised Azure account allowing     malformed payloads to be sent to the device via IoT Hub service, 2. By passing IoT hub service max message     payload limit of 128KB, and 3. Ability to overwrite code space with remote code. Fixed in commit     https://github.com/Azure/azure-c-shared-utility/commit/1129147c38ac02ad974c4c701a1e01b2141b9fe2.
    (CVE-2024-29195)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The azure-c-shared-utility is a C library for AMQP/MQTT communication to Azure Cloud Services. This     library may be used by the Azure IoT C SDK for communication between IoT Hub and IoT Hub devices. An     attacker can cause an integer wraparound or under-allocation or heap buffer overflow due to     vulnerabilities in parameter checking mechanism, by exploiting the buffer length parameter in Azure C SDK,     which may lead to remote code execution. Requirements for RCE are 1. Compromised Azure account allowing     malformed payloads to be sent to the device via IoT Hub service, 2. By passing IoT hub service max message     payload limit of 128KB, and 3. Ability to overwrite code space with remote code. Fixed in commit     https://github.com/Azure/azure-c-shared-utility/commit/1129147c38ac02ad974c4c701a1e01b2141b9fe2.
    (CVE-2024-29195)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
233164	Azure Linux 3.0 Security Update: azure-iot-sdk-c (CVE-2024-29195)	Nessus	Azure Linux Local Security Checks	medium
233159	CBL Mariner 2.0 Security Update: azure-iot-sdk-c (CVE-2024-29195)	Nessus	MarinerOS Local Security Checks	medium
227703	Linux Distros Unpatched Vulnerability : CVE-2024-29195	Nessus	Misc.	medium

Detections

Analytics

CVE-2024-29195

medium

Tenable Plugins

medium

medium

medium