{"id":101307,"date":"2021-09-17T10:22:35","date_gmt":"2021-09-17T08:22:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure"},"modified":"2021-09-17T10:22:35","modified_gmt":"2021-09-17T08:22:35","slug":"udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","title":{"rendered":"Dob\u00ebsi e shfryt\u00ebzueshme n\u00eb distanc\u00eb n\u00eb agjentin OMI, i imponuar n\u00eb mjediset Linux t\u00eb Microsoft Azure","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Klient\u00ebt e platform\u00ebs cloud Microsoft Azure, q\u00eb p\u00ebrdorin Linux n\u00eb ma\u0161in\u00ebn virtuale, u p\u00ebrball\u00ebn me nj\u00eb vulnerabilitet kritik (CVE-2021-38647), i cili lejon ekzekutimin e kodit n\u00eb distanc\u00eb me t\u00eb drejtat root. Vulnerabiliteti ka emrin kodor OMIGOD dhe \u00ebsht\u00eb i ve\u00e7ant\u00eb p\u00ebr shkak se problemi ndodhet n\u00eb aplikacionin OMI Agent, i cili instalohet n\u00eb m\u00ebnyr\u00eb t\u00eb heshtur n\u00eb mjediset Linux. <\/p>\n

OMI Agent instalohet dhe aktivizohet automatikisht gjat\u00eb p\u00ebrdorimit t\u00eb sh\u00ebrbimeve si Azure Automation, Azure Automatic Update, Azure Operations Management Suite, Azure Log Analytics, Azure Configuration Management, Azure Diagnostics dhe Azure Container Insights. P\u00ebr shembull, mjediset Linux n\u00eb Azure t\u00eb cilat kan\u00eb aktivizuar monitorimin jan\u00eb t\u00eb prekshme nga sulmi. Agjenti \u00ebsht\u00eb pjes\u00eb e paket\u00ebs s\u00eb hapur OMI (Open Management Infrastructure Agent) me implementimin e stekut DMTF CIM\/WBEM p\u00ebr menaxhimin e infrastruktur\u00ebs IT. <\/p>\n

OMI Agent instalohet n\u00eb sistem n\u00ebn p\u00ebrdoruesin omsagent dhe krijon konfigurime n\u00eb \/etc\/sudoers p\u00ebr t\u00eb ekzekutuar nj\u00eb s\u00ebr\u00eb skriptesh me t\u00eb drejtat root. Gjat\u00eb pun\u00ebs s\u00eb disa sh\u00ebrbimeve, krijohen socketa rrjeti q\u00eb d\u00ebgjojn\u00eb n\u00eb portet rrjetit 5985, 5986 dhe 1270. Skanime n\u00eb sh\u00ebrbimin Shodan tregojn\u00eb prani n\u00eb rrjet t\u00eb mbi 15 mij\u00eb mjediseve Linux t\u00eb prekshme. Aktualisht, nj\u00eb prototip funksional i eksploitit \u00ebsht\u00eb n\u00eb dispozicion publik, duke lejuar ekzekutimin e kodit t\u00eb vet me t\u00eb drejtat root n\u00eb k\u00ebto sisteme. <\/p>\n

Problemi p\u00ebrkeq\u00ebsohet nga fakti se n\u00eb Azure nuk dokumentohet qart\u00eb p\u00ebrdorimi i OMI dhe OMI Agent instalot pa paralajm\u00ebrim \u2014 mjafton t\u00eb pranoni kushtet e sh\u00ebrbimit t\u00eb zgjedhur gjat\u00eb konfigurimit t\u00eb mjedisit dhe OMI Agent do t\u00eb aktivizohet automatikisht, dometh\u00ebn\u00eb shumica e p\u00ebrdoruesve as nuk dyshojn\u00eb n\u00eb pranin\u00eb e tij. <\/p>\n

Metoda e shfryt\u00ebzimit \u00ebsht\u00eb banale \u2014 mjafton t\u00eb d\u00ebrgoni nj\u00eb k\u00ebrkes\u00eb XML tek agjenti, duke eliminuar kok\u00ebn p\u00ebrgjegj\u00ebse p\u00ebr autentifikimin. OMI p\u00ebrdor autentifikim kur merr mesazhe menaxhuese, duke verifikuar q\u00eb klienti ka t\u00eb drejt\u00eb t\u00eb d\u00ebrgoj\u00eb at\u00eb ose at\u00eb komand\u00eb. Natyra e dob\u00ebsis\u00eb q\u00ebndron n\u00eb faktin se duke eliminuar n\u00eb mesazh kok\u00ebn \"Authentication\", e cila \u00ebsht\u00eb p\u00ebrgjegj\u00ebse p\u00ebr autentifikimin, server<\/a> e konsideron kalimin e verifikimit t\u00eb suksessh\u00ebm, e pranon mesazhin menaxhues dhe lejon ekzekutimin e komandave me t\u00eb drejta root. P\u00ebr t\u00eb ekzekutuar komanda t\u00eb arbitrale n\u00eb sistem, mjafton t\u00eb p\u00ebrdorni n\u00eb mesazh komand\u00ebn standarde ExecuteShellCommand_INPUT. P\u00ebr shembull, p\u00ebr t\u00eb nisur utilitarin \"id\" mjafton t\u00eb d\u00ebrgoni k\u00ebrkes\u00ebn: curl -H \"Content-Type: application\/soap+xml;charset=UTF-8\" -k --data-binary \"@http_body.txt\" https:\/\/10.0.0.5:5986\/wsman ...

id<\/p>

0<\/p> <\/p> <\/s> <\/s> <\/p>\n

Kompania Microsoft ka l\u00ebshuar tashm\u00eb nj\u00eb p\u00ebrdit\u00ebsim OMI 1.6.8.1 q\u00eb adreson dob\u00ebsin\u00eb, por ajo ende nuk \u00ebsht\u00eb arritur te p\u00ebrdoruesit e Microsoft Azure (n\u00eb mjediset e reja vazhdon t\u00eb instalohet versioni i vjet\u00ebr i OMI). Auto-p\u00ebrdit\u00ebsimi i agentit nuk mb\u00ebshtetet, prandaj p\u00ebrdoruesit duhet t\u00eb kryejn\u00eb p\u00ebrdit\u00ebsimin e paket\u00ebs manualisht, duke p\u00ebrdorur komandat \"dpkg -l omi\" n\u00eb Debian\/Ubuntu ose \"rpm -qa omi\" n\u00eb Fedora\/RHEL. Si nj\u00eb mund\u00ebsi p\u00ebr mbrojtje, rekomandohet bllokimi i aksesit n\u00eb portet rrjet 5985, 5986 dhe 1270. <\/p>\n

P\u00ebrve\u00e7 CVE-2021-38647, n\u00eb OMI 1.6.8.1 jan\u00eb zgjidhur gjithashtu tre vulnerabilitete (CVE-2021-38648, CVE-2021-38645 dhe CVE-2021-38649) q\u00eb lejojn\u00eb nj\u00eb p\u00ebrdorues lokal pa privilegje t\u00eb ekzekutoj\u00eb kodin e tij me t\u00eb drejtat root.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043b\u0438\u0435\u043d\u0442\u044b \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Microsoft Azure, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 Linux \u0432 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445, \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e (CVE-2021-38647), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f OMIGOD \u0438 \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0438 OMI Agent, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0431\u0435\u0437 \u043b\u0438\u0448\u043d\u0435\u0439 \u043e\u0433\u043b\u0430\u0441\u043a\u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0432 Linux-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. OMI Agent \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0438 \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0442\u0430\u043a\u0438\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432, \u043a\u0430\u043a […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101307","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilitet n\u00eb OMI-aganetin e shfryt\u00ebzuar n\u00eb distanc\u00eb, i imponuar n\u00eb mjediset Linux t\u00eb Microsoft Azure | ProHoster","description":"Klient\u00ebt e platform\u00ebs cloud Microsoft Azure, q\u00eb p\u00ebrdorin Linux n\u00eb ma\u0161in\u00ebn virtuale, u p\u00ebrball\u00ebn me nj\u00eb vulnerabilitet kritik (CVE-2021-38647), i cili lejon ekzekutimin e kodit n\u00eb distanc\u00eb me t\u00eb drejtat root. Vulnerabiliteti ka emrin kodor OMIGOD dhe \u00ebsht\u00eb i ve\u00e7ant\u00eb p\u00ebr shkak se problemi ndodhet n\u00eb aplikacionin OMI Agent, i cili instalohet n\u00eb m\u00ebnyr\u00eb t\u00eb heshtur n\u00eb mjediset Linux. OMI Agent instalohet dhe aktivizohet automatikisht gjat\u00eb p\u00ebrdorimit t\u00eb sh\u00ebrbimeve si","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OMI-\u0430\u0433\u0435\u043d\u0442\u0435, \u043d\u0430\u0432\u044f\u0437\u044b\u0432\u0430\u0435\u043c\u043e\u043c \u0432 Linux-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u0445 Microsoft Azure | ProHoster","og:description":"\u041a\u043b\u0438\u0435\u043d\u0442\u044b \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Microsoft Azure, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 Linux \u0432 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445, \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e (CVE-2021-38647), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f OMIGOD \u0438 \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0438 OMI Agent, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0431\u0435\u0437 \u043b\u0438\u0448\u043d\u0435\u0439 \u043e\u0433\u043b\u0430\u0441\u043a\u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0432 Linux-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. OMI Agent \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0438 \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0442\u0430\u043a\u0438\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432, \u043a\u0430\u043a","og:url":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-17T08:22:35+00:00","article:modified_time":"2021-09-17T08:22:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101307","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-17 08:49:36","updated":"2022-10-07 00:05:27","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/101307","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=101307"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/101307\/revisions"}],"predecessor-version":[{"id":172940,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/101307\/revisions\/172940"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=101307"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=101307"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=101307"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}