Threat Brief: OMI Vulnerabilities (CVE-2021-38645, CVE-2021-38647, CVE-2021-38648 and CVE-2021-38649)
Summary: On Sept. 14, 2021, Microsoft's MSRC released patches for four critical vulnerabilities in the open-source Open Management Infrastructure (OMI) package, which Azure uses to manage UNIX and Linux systems in VMs, containers and serverless instances. The flaws, found by Wiz researchers and dubbed OMIGOD, include one unauthenticated remote code execution and three privilege escalation vulnerabilities, and Microsoft said systems created or updated after Aug. 11, 2021 should be automatically patched.
Bottom line: One of the four flaws is unauthenticated remote code execution in a management agent that ships inside Azure Linux instances by default, so any unpatched host created before Aug. 11, 2021 is exposed without the attacker needing credentials.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-38645CVE-2021-38647CVE-2021-38648CVE-2021-38649
- Related
- Threat Source newsletter (Sept. 23, 2021) Cyber Risks ·CVE-2021-38648: Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021