Microsoft Releases Security Update for Azure Linux Open Management Infrastructure

guest · Sep 16, 2021

Microsoft Releases Security Update for Azure Linux Open Management Infrastructure
September 16, 2021
https://us-cert.cisa.gov/ncas/curre...s-security-update-azure-linux-open-management

Microsoft has released an update to address a remote code execution vulnerability in Azure Linux Open Management Infrastructure (OMI). An attacker could use this vulnerability to take control of an affected system.

CISA encourages users and administrators to review the Microsoft Security Advisory to apply the necessary update.
Click to expand...

guest · Oct 3, 2021

mood said: ↑

Microsoft Releases Security Update for Azure Linux Open Management Infrastructure September 16, 2021
Click to expand...

(Updated, September 17)

On September 16, 2021, Microsoft released additional guidance on Open Management Infrastructure (OMI) vulnerabilities—CVE-2021-38645, CVE-2021-38649, CVE-2021-38648, and CVE-2021-38647—which impact Azure VM Management Extensions. According to Microsoft, “[c]ustomers must update vulnerable extensions for their Cloud and On-Premises deployments as the updates become available…”

CISA encourages organizations to review Additional Guidance Regarding OMI Vulnerabilities within Azure VM Management Extensions for more information and to:

ensure automatic updates are applied

ensure manual updates are applied, as patches are made available

restrict external access to Linux systems that expose OMI ports (TCP 5985, 5986, and 1270)

Click to expand...

guest · Oct 3, 2021

Mirai botnet exploiting Azure OMIGOD vulnerabilities
September 20, 2021
https://www.hackread.com/mirai-botnet-exploiting-azure-omigod-vulnerabilities/

Critical Microsoft Azure vulnerabilities reported and patched earlier this week are actively exploited by threat actors and cybercriminals. Dubbed the OMIGOD flaws; the vulnerabilities were originally discovered by the Wiz Research Team.

On the other hand, security researcher Germán Fernández identified one of the botnets trying to exploit the reported vulnerabilities. Fernández tweeted that attackers are searching for Azure Linux virtual machines as these are vulnerable to a remote code execution flaw identified in Azure.
This finding was confirmed by Bad Packets security firm.
Click to expand...

In a conversation with Cado Security, Stuart said that:

“As this is now confirmed as being actively scanned and exploited in an automated fashion via botnets, and we know there is the potential for root privilege remote code execution, any open OMI ports must be closed as soon as possible, and Azure mitigation guidelines need to be implemented.”
Click to expand...

guest · Oct 3, 2021

CVE-2021-38647 OMIGOD flaw impacts IBM QRadar Azure
...and can be exploited by remote attackers to execute arbitrary code.
October 3, 2021
https://securityaffairs.co/wordpress/122869/security/cve-2021-38647-omigod-ibm-qradar-azure.html

The Open Management Infrastructure RPM package in the IBM QRadar Azure marketplace images is affected by a remote code execution vulnerability tracked as CVE-2021-38647.

CVE-2021-38647 is one of the four vulnerabilities in the Open Management Infrastructure (OMI) software, collectively tracked as OMIGOD, that were first reported by Wiz’s research team. Microsoft fixed the flaw with the release of September 2021 Patch Tuesday security updates.
Click to expand...

The most severe flaw is a remote code execution flaw tracked as CVE-2021-38647, it received a CVSS score of 9.8.

“IBM QRadar Azure marketplace images include the Open Management Infrastructure RPM which is vulnerable to CVE-2021-38647. Although we do not expose the affected port, we suggest updating out of an abundance of caution.” reads the advisory published by IBM. “Microsoft Azure Open Management Infrastructure could allow a remote attacker to execute arbitrary code on the system. By executing a specially-crafted program, an attacker could exploit this vulnerability to execute arbitrary code on the system.”
A remote, unauthenticated attacker could exploit the vulnerability by sending a specially crafted message via HTTPS to port listening to OMI on a vulnerable system.
Click to expand...

Log in or Sign up

Microsoft Releases Security Update for Azure Linux Open Management Infrastructure

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Microsoft Releases Security Update for Azure Linux Open Management Infrastructure

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches