{"id":101307,"date":"2021-09-17T10:22:35","date_gmt":"2021-09-17T08:22:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure"},"modified":"2021-09-17T10:22:35","modified_gmt":"2021-09-17T08:22:35","slug":"udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","title":{"rendered":"T\u00e1voli kihaszn\u00e1lhat\u00f3 s\u00e9r\u00fcl\u00e9kenys\u00e9g az OMI-\u00fcgyn\u00f6kben, amelyet a Microsoft Azure Linux-k\u00f6rnyezeteiben alkalmaznak","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A Microsoft Azure cloud platform customers using Linux in virtual machines have encountered a critical vulnerability (CVE-2021-38647) that allows remote code execution with root privileges. The vulnerability has been given the code name OMIGOD and is noteworthy because the issue exists in the OMI Agent application, which is quietly installed in Linux environments. <\/p>\n

The OMI Agent is automatically installed and activated when using services such as Azure Automation, Azure Automatic Update, Azure Operations Management Suite, Azure Log Analytics, Azure Configuration Management, Azure Diagnostics, and Azure Container Insights. For example, Linux environments in Azure with monitoring enabled are vulnerable. The agent is part of the open OMI (Open Management Infrastructure Agent) package, which implements the DMTF CIM\/WBEM stack for managing IT infrastructure. <\/p>\n

The OMI Agent is installed on the system under the omsagent user and creates settings in \/etc\/sudoers to run a series of scripts with root privileges. During the operation of certain services, listening network sockets are created on network ports 5985, 5986, and 1270. Scanning with the Shodan service shows that there are over 15,000 vulnerable Linux environments online. Currently, a working prototype of an exploit is already available that allows executing one's code with root privileges on such systems. <\/p>\n

A probl\u00e9ma s\u00falyosbodik, hogy az Azure-ban egy\u00e9rtelm\u0171en nincs dokument\u00e1lva az OMI alkalmaz\u00e1sa, \u00e9s az OMI \u00fcgyn\u00f6k figyelmeztet\u00e9s n\u00e9lk\u00fcl telep\u00fcl \u2014 el\u00e9g, ha elfogadja a v\u00e1lasztott szolg\u00e1ltat\u00e1s felt\u00e9teleit a k\u00f6rnyezet be\u00e1ll\u00edt\u00e1sakor, \u00e9s az OMI \u00fcgyn\u00f6k automatikusan aktiv\u00e1l\u00f3dik, azaz a legt\u00f6bb felhaszn\u00e1l\u00f3 m\u00e9g csak nem is tud a l\u00e9tez\u00e9s\u00e9r\u0151l. <\/p>\n

A sebezhet\u0151s\u00e9g kihaszn\u00e1l\u00e1s\u00e1nak m\u00f3dja trivi\u00e1lis \u2014 el\u00e9g, ha egy XML-lek\u00e9rdez\u00e9st k\u00fcld az \u00fcgyn\u00f6knek, elt\u00e1vol\u00edtva az azonos\u00edt\u00e1s\u00e9rt felel\u0151s fejl\u00e9cet. Az OMI az ir\u00e1ny\u00edt\u00f3 \u00fczenetek megk\u00edr\u00e9sekor ellen\u0151rzi, hogy az \u00fcgyf\u00e9l jogosult-e a konkr\u00e9t parancs elk\u00fcld\u00e9s\u00e9re. A sebezhet\u0151s\u00e9g l\u00e9nyege, hogy a \u201eAuthentication\u201d fejl\u00e9c elt\u00e1vol\u00edt\u00e1s\u00e1val az \u00fczenetben szerver<\/a> a rendszer sikeresnek tekinti a hiteles\u00edt\u00e9st, elfogadja az ir\u00e1ny\u00edt\u00f3 \u00fczenetet, \u00e9s lehet\u0151v\u00e9 teszi a root jogosults\u00e1g\u00fa parancsok v\u00e9grehajt\u00e1s\u00e1t. Az \u00f6nk\u00e9nyes parancsok v\u00e9grehajt\u00e1s\u00e1hoz elegend\u0151 az \u00fczenetben a standard ExecuteShellCommand_INPUT parancsot haszn\u00e1lni. P\u00e9ld\u00e1ul a \u201eid\u201d seg\u00e9dprogram futtat\u00e1s\u00e1hoz csak annyit kell k\u00fcldeni: curl -H 'Content-Type: application\/soap+xml;charset=UTF-8' -k --data-binary '@http_body.txt' https:\/\/10.0.0.5:5986\/wsman \u2026

id<\/p>

0<\/p> <\/p> <\/s> <\/s> <\/p>\n

A Microsoft m\u00e1r kiadta az OMI 1.6.8.1 friss\u00edt\u00e9s\u00e9t a sebezhet\u0151s\u00e9g megsz\u00fcntet\u00e9s\u00e9vel, de ezt m\u00e9g nem juttatt\u00e1k el a Microsoft Azure felhaszn\u00e1l\u00f3ihoz (az \u00faj k\u00f6rnyezetekben tov\u00e1bbra is a r\u00e9gi OMI verzi\u00f3 telep\u00fcl). Az \u00fcgyn\u00f6k automatikus friss\u00edt\u00e9se nem t\u00e1mogatott, ez\u00e9rt a felhaszn\u00e1l\u00f3knak manu\u00e1lisan kell friss\u00edteni\u00fck a csomagot a 'dpkg -l omi' parancs haszn\u00e1lat\u00e1val Debian\/Ubuntu alatt, vagy 'rpm -qa omi' parancs haszn\u00e1lat\u00e1val Fedora\/RHEL alatt. V\u00e9delmi megold\u00e1sk\u00e9nt aj\u00e1nlott a 5985, 5986 \u00e9s 1270-es h\u00e1l\u00f3zati portok hozz\u00e1f\u00e9r\u00e9s\u00e9nek blokkol\u00e1sa. <\/p>\n

Az OMI 1.6.8.1-ben a CVE-2021-38647 mellett h\u00e1rom m\u00e1sik sebezhet\u0151s\u00e9get (CVE-2021-38648, CVE-2021-38645 \u00e9s CVE-2021-38649) is kijav\u00edtottak, amelyek lehet\u0151v\u00e9 teszik egy nem privilegiz\u00e1lt helyi felhaszn\u00e1l\u00f3 sz\u00e1m\u00e1ra, hogy k\u00f3dot futtasson root jogosults\u00e1gokkal.
\n
Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043b\u0438\u0435\u043d\u0442\u044b \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Microsoft Azure, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 Linux \u0432 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445, \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e (CVE-2021-38647), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f OMIGOD \u0438 \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0438 OMI Agent, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0431\u0435\u0437 \u043b\u0438\u0448\u043d\u0435\u0439 \u043e\u0433\u043b\u0430\u0441\u043a\u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0432 Linux-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. OMI Agent \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0438 \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0442\u0430\u043a\u0438\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432, \u043a\u0430\u043a […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101307","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47T\u00e1volr\u00f3l kihaszn\u00e1lhat\u00f3 sebezhet\u0151s\u00e9g az OMI \u00fcgyn\u00f6kben, amelyet a Microsoft Azure Linux k\u00f6rnyezeteibe implant\u00e1lnak | ProHoster","description":"A Microsoft Azure felh\u0151platform \u00fcgyfelei, akik Linuxot haszn\u00e1lnak virtu\u00e1lis g\u00e9peken, kritikus sebezhet\u0151s\u00e9ggel (CVE-2021-38647) szembes\u00fcltek, amely lehet\u0151v\u00e9 teszi a k\u00f3d t\u00e1voli v\u00e9grehajt\u00e1s\u00e1t root jogosults\u00e1gokkal.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OMI-\u0430\u0433\u0435\u043d\u0442\u0435, \u043d\u0430\u0432\u044f\u0437\u044b\u0432\u0430\u0435\u043c\u043e\u043c \u0432 Linux-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u0445 Microsoft Azure | ProHoster","og:description":"\u041a\u043b\u0438\u0435\u043d\u0442\u044b \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Microsoft Azure, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 Linux \u0432 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445, \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e (CVE-2021-38647), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-17T08:22:35+00:00","article:modified_time":"2021-09-17T08:22:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101307","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-17 08:49:36","updated":"2022-10-07 00:05:27","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/101307","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=101307"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/101307\/revisions"}],"predecessor-version":[{"id":172940,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/101307\/revisions\/172940"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=101307"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=101307"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=101307"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}