September 16, 2021
Azure users who currently run Linux virtual machines may not be aware that they have a very vulnerable Microsoft management software installed on their machine that can be easily exploited remotely.
As described by Wiz.io, which has identified four vulnerabilities in Microsoft’s Open Management Infrastructure (OMI) project, an attacker is able to have root access to a remote machine when sending a single packet with the deleted authentication header.
“This is a textbook RCE vulnerability that you would expect to see in the ’90s — it’s highly unusual to have one crop up in 2021 that can expose millions of endpoints,” wrote Wiz security expert Nir Ohfeld.
As Ohfeld describes, the problem for users is that OMI is quietly installed when users install log collection, has no public documentation and runs with root privileges. Wiz found that over 65% of Azure users running Linux were vulnerable.
In its advisory published today on the four CVEs – CVE-2021-38647 rated at 9.8, CVE-2021-38648 rated at 7.8, CVE-2021-38645 rated at 7.8 and CVE-2021-38649 rated at 7.0 – Microsoft explained that fixing the vulnerabilities was set out in its OMI code on August 11 to give partners time to update before specifying the issues.
Users should use OMI version 1.6.8.1, where Microsoft instructs users to download OMI updates from their repositories if the machines are not yet updated.
Microsoft’s latest Patch released on Tuesday addresses these vulnerabilities, known as OMIGOD.
For more information, read the original story in ZDNet.
