{"id":101307,"date":"2021-09-17T10:22:35","date_gmt":"2021-09-17T08:22:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure"},"modified":"2021-09-17T10:22:35","modified_gmt":"2021-09-17T08:22:35","slug":"udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hr\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","title":{"rendered":"Daljinski iskori\u0161tavana ranjivost u OMI agentu, nametnutom u Linux okru\u017eenjima Microsoft Azure","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Korisnici Microsoft Azure oblaka koji koriste Linux na virtualnim strojevima suo\u010dili su se s kriti\u010dnom ranjivo\u0161\u0107u (CVE-2021-38647) koja omogu\u0107ava daljinsko izvo\u0111enje koda s root pravima. Ranjivost nosi kodno ime OMIGOD i zna\u010dajna je jer je problem prisutan u aplikaciji OMI Agent koja se neprimjetno instalira u Linux okru\u017eenja. <\/p>\n

OMI Agent se automatski instalira i aktivira prilikom kori\u0161tenja usluga kao \u0161to su Azure Automation, Azure Automatic Update, Azure Operations Management Suite, Azure Log Analytics, Azure Configuration Management, Azure Diagnostics i Azure Container Insights. Na primjer, Linux okru\u017eenja u Azuru koja imaju uklju\u010deno pra\u0107enje su podlo\u017ena napadima. Agent je dio otvorenog paketa OMI (Open Management Infrastructure Agent) s implementacijom DMTF CIM\/WBEM stoga za upravljanje IT infrastrukturom. <\/p>\n

OMI Agent se instalira na sustavu pod korisnikom omsagent i kreira postavke u \/etc\/sudoers za pokretanje niza skripti s root pravima. Tijekom rada nekih usluga kreiraju se aktivni mre\u017eni soketi na mre\u017enim portovima 5985, 5986 i 1270. Skeniranje u Shodan servisu pokazuje prisutnost vi\u0161e od 15 tisu\u0107a ranjivih Linux okru\u017eenja. Trenutno je u javnosti ve\u0107 dostupan radni prototip exploit-a koji omogu\u0107uje izvo\u0111enje vlastitog koda s root pravima na sli\u010dnim sustavima. <\/p>\n

Problem se dodatno pogor\u0161ava time \u0161to je u Azure-u o\u010dito nedokumentirana primjena OMI-ja, a OMI Agent se instalira bez upozorenja \u2014 dovoljno je slo\u017eiti se s uvjetima odabranog servisa prilikom postavljanja okru\u017eenja, i OMI Agent \u0107e automatski biti aktiviran, tj. ve\u0107ina korisnika ni ne sumnja u njegovo postojanje. <\/p>\n

Metod iskori\u0161tavanja je trivijalan \u2014 dovoljno je poslati XML zahtjev agentu, ukloniv\u0161i zaglavlje koje se odnosi na autentifikaciju. OMI koristi autentifikaciju kada prima upravlja\u010dke poruke, provjeravaju\u0107i ima li klijent pravo slati odre\u0111enu naredbu. Bit ranjivosti je u tome \u0161to prilikom uklanjanja zaglavlja \u201eAuthentication\u201d u poruci, koje se odnosi na autentifikaciju, server<\/a> smatra da je provjera uspje\u0161na, prihva\u0107a upravlja\u010dku poruku i omogu\u0107ava izvr\u0161avanje naredbi s root pravima. Za izvr\u0161avanje proizvoljnih naredbi u sustavu dovoljno je koristiti u poruci standardnu naredbu ExecuteShellCommand_INPUT. Na primjer, za pokretanje alata \u201eid\u201d dovoljno je poslati zahtjev: curl -H 'Content-Type: application\/soap+xml;charset=UTF-8' -k --data-binary '@http_body.txt' https:\/\/10.0.0.5:5986\/wsman \u2026

id<\/p>

0<\/p> <\/p> <\/s> <\/s> <\/p>\n

Tvrtka Microsoft ve\u0107 je izdala a\u017euriranje OMI 1.6.8.1 koje ispravlja ranjivost, ali ono jo\u0161 nije dostupno korisnicima Microsoft Azure-a (u novim okru\u017eenjima se jo\u0161 instalira stara verzija OMI-ja). Automatsko a\u017euriranje agenta nije podr\u017eano, stoga korisnicima treba ru\u010dno a\u017eurirati paket, koriste\u0107i naredbe \u201edpkg -l omi\u201d u Debian\/Ubuntu ili \u201erpm -qa omi\u201d u Fedora\/RHEL. Kao zaobilazno rje\u0161enje za za\u0161titu preporu\u010duje se blokirati pristup mre\u017enim portovima 5985, 5986 i 1270. <\/p>\n

Osim CVE-2021-38647, OMI 1.6.8.1 tako\u0111er otklanja tri ranjivosti (CVE-2021-38648, CVE-2021-38645 i CVE-2021-38649) koje omogu\u0107avaju neprivilegiranom lokalnom korisniku da izvr\u0161i svoj kod s root privilegijama.
\n
Izvor: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043b\u0438\u0435\u043d\u0442\u044b \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Microsoft Azure, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 Linux \u0432 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445, \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e (CVE-2021-38647), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f OMIGOD \u0438 \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0438 OMI Agent, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0431\u0435\u0437 \u043b\u0438\u0448\u043d\u0435\u0439 \u043e\u0433\u043b\u0430\u0441\u043a\u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0432 Linux-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. OMI Agent \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0438 \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0442\u0430\u043a\u0438\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432, \u043a\u0430\u043a […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101307","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Daljinski iskori\u0161tavana ranjivost u OMI agentu koji se name\u0107e u Linux okru\u017eenjima Microsoft Azure | ProHoster","description":"Korisnici cloud platforme Microsoft Azure koji koriste Linux na virtualnim strojevima suo\u010dili su se s kriti\u010dnom ranjivo\u0161\u0107u (CVE-2021-38647) koja omogu\u0107ava daljinsko izvr\u0161avanje koda s root privilegijama.","canonical_url":"https:\/\/prohoster.info\/hr\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hr_HR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OMI-\u0430\u0433\u0435\u043d\u0442\u0435, \u043d\u0430\u0432\u044f\u0437\u044b\u0432\u0430\u0435\u043c\u043e\u043c \u0432 Linux-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u0445 Microsoft Azure | ProHoster","og:description":"\u041a\u043b\u0438\u0435\u043d\u0442\u044b \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Microsoft Azure, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 Linux \u0432 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445, \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e (CVE-2021-38647), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root.","og:url":"https:\/\/prohoster.info\/hr\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-17T08:22:35+00:00","article:modified_time":"2021-09-17T08:22:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101307","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-17 08:49:36","updated":"2022-10-07 00:05:27","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/101307","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/comments?post=101307"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/101307\/revisions"}],"predecessor-version":[{"id":172940,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/posts\/101307\/revisions\/172940"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/media?parent=101307"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/categories?post=101307"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hr\/wp-json\/wp\/v2\/tags?post=101307"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}