vulnerabilities OMI vulnerabilities threaten Linux virtual machines on Microsoft Azure The Open Management Infrastructure agent, with four vulnerabilities, is being automatically installed on virtual Linux machines on Microsoft Azure. Hugh Aver September 16, 2021 News has surfaced of a rather dangerous practice in Microsoft Azure, whereby when a user creates a Linux virtual machine and enables certain Azure services, the Azure platform automatically installs the Open Management Infrastructure (OMI) agent on the machine. The user won’t know it. Although a stealth installation might sound terrible on its face, this one actually wouldn’t be so bad were it not for two issues: First, the agent has known vulnerabilities, and second, the agent has no automatic update mechanism in Azure. Until Microsoft solves this problem on its end, organizations using Linux virtual machines on Azure will need to take action. Vulnerabilities in the Open Management Infrastructure, and how attackers can exploit them On September’s Patch Tuesday, Microsoft released security updates for four vulnerabilities in the Open Management Infrastructure agent. One of them, CVE-2021-38647, allows remote code execution (RCE) and is critical, and the other three, CVE-2021-38648, CVE-2021-38645, and CVE-2021-38649, can be used for privilege escalation (LPE) in multistage attacks when attackers have penetrated a victim’s network in advance. These three vulnerabilities score high on the CVSS. When Microsoft Azure users create a Linux virtual machine and enable a series of services, OMI —vulnerabilities and all — deploys in the system automatically. The services include Azure Automation, Azure Automatic Update, Azure Operations Management Suite, Azure Log Analytics, Azure Configuration Management, and Azure Diagnostics, a list that is probably far from complete. The Open Management Infrastructure agent on its own has the highest privileges in the system, and because its tasks include collecting statistics and syncing configurations, it is generally accessible from the Internet through various HTTP ports, depending on the services enabled. For example, if the listening port is 5986, attackers could potentially exploit the CVE-2021-38647 vulnerability and execute malicious code remotely. If the OMI is available for remote management (through port 5986, 5985, or 1270), outsiders can exploit the same vulnerability to gain access to the entire network neighborhood in Azure. Experts say the vulnerability is very easy to exploit. This is even more severe. The RCE is the simplest RCE you can ever imagine. Simply remove the auth header and you are root. remotely. on all machines. Is this really 2021? pic.twitter.com/iIHNyqgew4 — Ami Luttwak (@amiluttwak) September 14, 2021 So far, no in-the-wild attacks have been reported, but with a lot of information available about how easy it exploiting these vulnerabilities would be, it probably won’t be long. How to protect yourself Microsoft has released patches for all four vulnerabilities. However, OMI does not always automatically update, so you’ll need to check to see which version is deployed on your Linux virtual machine. If it’s older than 1.6.8.1, update the Open Management Infrastructure agent. To see how, refer to the description of the CVE-2021-38647 vulnerability. Experts also recommend restricting network access to ports 5985, 5986, and 1270 to prevent anyone from running RCE.
Read next Router protection for MikroTik users To protect MikroTik routers from the Mēris botnet, or to clean a previously infected router, users should update RouterOS and check settings.
Tips Reading between the lines: how to read e-books safely We break down how to use e-books safely, and which rules to follow when searching for books online, so you don’t fall victim to scammers
Tips The eMudhra certificate incident: how organizations can respond How a certificate’s private key ended up being equal to 4, and why browser updates alone won’t protect you from vulnerable eMudhra certificates.
Tips How to improve your resume with AI without exposing your data Let’s look at how to use AI as a resume editor without oversharing to build a document that gets past automated screening systems and catches a recruiter’s eye.
Tips How can students overcome the fear of unfulfilled potential, and where does cybersecurity come into it? University students sometimes don’t see the practical value of what they’re studying, and aren’t always sure what to do next. Kaspersky Academy’s free “Cybersecurity. Entry Level” course can help them pick up in-demand skills directly from Kaspersky experts.