{"id":101307,"date":"2021-09-17T10:22:35","date_gmt":"2021-09-17T08:22:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure"},"modified":"2021-09-17T10:22:35","modified_gmt":"2021-09-17T08:22:35","slug":"udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","title":{"rendered":"Cenueshm\u00ebri e shfryt\u00ebzueshme nga distanca n\u00eb agjentin OMI, t\u00eb imponuar n\u00eb mjediset Linux t\u00eb Microsoft Azure","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Klient\u00ebt e platform\u00ebs cloud Microsoft Azure q\u00eb p\u00ebrdorin Linux n\u00eb virtualizime kan\u00eb hasur n\u00eb nj\u00eb vulnerabilitet kritik (CVE-2021-38647), i cili lejon ekzekutimin e kodit nga distanca me privilegje root. Vulnerabiliteti ka emrin kod OMIGOD dhe \u00ebsht\u00eb i njohur p\u00ebr faktin se problemi ekziston n\u00eb aplikacionin OMI Agent, i cili instalohet pa nj\u00eb njoftim t\u00eb tepruar n\u00eb ambientet Linux. <\/p>\n

OMI Agent instalohet dhe aktivizohet automatikisht kur p\u00ebrdoren sh\u00ebrbime si Azure Automation, Azure Automatic Update, Azure Operations Management Suite, Azure Log Analytics, Azure Configuration Management, Azure Diagnostics dhe Azure Container Insights. P\u00ebr shembull, ambientet Linux n\u00eb Azure t\u00eb cilat kan\u00eb aktivizuar monitorimin, jan\u00eb t\u00eb prekshme nga sulmet. Agjenti \u00ebsht\u00eb pjes\u00eb e paket\u00ebs s\u00eb hapur OMI (Open Management Infrastructure Agent) me implementimin e stack-ut DMTF CIM\/WBEM p\u00ebr menaxhimin e infrastruktur\u00ebs IT. <\/p>\n

OMI Agent instalohet n\u00eb sistem n\u00ebn p\u00ebrdoruesin omsagent dhe krijon konfigurime n\u00eb \/etc\/sudoers p\u00ebr t\u00eb ekzekutuar nj\u00eb seri skriptesh me privilegje root. Gjat\u00eb funksionimit t\u00eb disa sh\u00ebrbimeve, krijohen socket-a t\u00eb d\u00ebgjimit n\u00eb porte rrjeti 5985, 5986 dhe 1270. Skanime n\u00eb sh\u00ebrbimin Shodan tregojn\u00eb se n\u00eb rrjet ekzistojn\u00eb m\u00eb shum\u00eb se 15,000 ambiente Linux t\u00eb prekshme. Aktualisht \u00ebsht\u00eb publikuar nj\u00eb prototip funksional i exploit-it, i cili lejon ekzekutimin e kodit t\u00eb tij me privilegje root n\u00eb k\u00ebto sisteme. <\/p>\n

Problemi p\u00ebrkeq\u00ebsohet nga fakti se n\u00eb Azure p\u00ebrdorimi i OMI nuk \u00ebsht\u00eb dokumentuar qart\u00eb dhe OMI Agent instalohet pa paralajm\u00ebrim \u2014 mjafton t\u00eb pranoni kushtet e sh\u00ebrbimit t\u00eb zgjedhur gjat\u00eb konfigurimit t\u00eb ambientit dhe OMI Agent aktivizohet automatikisht, q\u00eb do t\u00eb thot\u00eb se shumica e p\u00ebrdoruesve as nuk e din\u00eb p\u00ebr ekzistenc\u00ebn e tij. <\/p>\n

Metoda e shfryt\u00ebzimit \u00ebsht\u00eb triviiale \u2014 mjafton t\u00eb d\u00ebrgoni nj\u00eb k\u00ebrkes\u00eb XML te agjenti duke eliminuar titullin q\u00eb \u00ebsht\u00eb p\u00ebrgjegj\u00ebs p\u00ebr autentikimin. OMI p\u00ebrdor autentikimin kur merr mesazhe menaxhuese, duke verifikuar se klienti ka t\u00eb drejt\u00eb t\u00eb d\u00ebrgoj\u00eb komand\u00ebn p\u00ebrkat\u00ebse. Thelbi i dob\u00ebsis\u00eb q\u00ebndron n\u00eb faktin se duke eliminuar titullin \"Authentication\" n\u00eb mesazh, server<\/a> ajo e konsideron kalimin n\u00eb verifikim t\u00eb suksessh\u00ebm, pranon mesazhin menaxhues dhe lejon ekzekutimin e komandave me t\u00eb drejta root. P\u00ebr t\u00eb ekzekutuar komanda t\u00eb rast\u00ebsishme n\u00eb sistem, mjafton t\u00eb p\u00ebrdorni n\u00eb mesazh komand\u00ebn standarde ExecuteShellCommand_INPUT. P\u00ebr shembull, p\u00ebr t\u00eb ekzekutuar utilitarin \"id\", mjafton t\u00eb d\u00ebrgoni k\u00ebrkes\u00ebn: curl -H \"Content-Type: application\/soap+xml;charset=UTF-8\" -k --data-binary \"@http_body.txt\" https:\/\/10.0.0.5:5986\/wsman ...

id<\/p>

0<\/p> <\/p> <\/s> <\/s> <\/p>\n

Kompania Microsoft ka l\u00ebshuar tashm\u00eb nj\u00eb p\u00ebrdit\u00ebsim OMI 1.6.8.1 q\u00eb adreson dob\u00ebsin\u00eb, por ai ende nuk \u00ebsht\u00eb shp\u00ebrndar\u00eb te p\u00ebrdoruesit e Microsoft Azure (n\u00eb ambientet e reja ende instalohet versioni i vjet\u00ebr i OMI). Rekomandohet q\u00eb p\u00ebrdit\u00ebsimi automatik i agjentit t\u00eb bllokohet, prandaj p\u00ebrdoruesit duhet t\u00eb b\u00ebjn\u00eb p\u00ebrdit\u00ebsimin e paket\u00ebs manualisht, duke p\u00ebrdorur komandat \"dpkg -l omi\" n\u00eb Debian\/Ubuntu ose \"rpm -qa omi\" n\u00eb Fedora\/RHEL. Si nj\u00eb zgjidhje p\u00ebr bllokimin e aksesit rekomandohet bllokimi i porteve rrjet 5985, 5986 dhe 1270. <\/p>\n

P\u00ebrve\u00e7 CVE-2021-38647, n\u00eb OMI 1.6.8.1 jan\u00eb zgjidhur gjithashtu tri dob\u00ebsi (CVE-2021-38648, CVE-2021-38645 dhe CVE-2021-38649), t\u00eb cilat lejojn\u00eb nj\u00eb p\u00ebrdorues lokal t\u00eb pa privilegjuar t\u00eb ekzekutoj\u00eb kodin e tij me t\u00eb drejtat root.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043b\u0438\u0435\u043d\u0442\u044b \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Microsoft Azure, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 Linux \u0432 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445, \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e (CVE-2021-38647), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f OMIGOD \u0438 \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0438 OMI Agent, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0431\u0435\u0437 \u043b\u0438\u0448\u043d\u0435\u0439 \u043e\u0433\u043b\u0430\u0441\u043a\u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0432 Linux-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. OMI Agent \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0438 \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0442\u0430\u043a\u0438\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432, \u043a\u0430\u043a […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101307","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Dob\u00ebsia e eksploituar n\u00eb distanc\u00eb n\u00eb agjentin OMI, i imponuar n\u00eb mjediset Linux t\u00eb Microsoft Azure | ProHoster","description":"Konsumator\u00ebt e platform\u00ebs s\u00eb cloud Microsoft Azure, q\u00eb p\u00ebrdorin Linux n\u00eb makinat virtuale, jan\u00eb p\u00ebrballur me nj\u00eb dob\u00ebsi kritike (CVE-2021-38647), e cila lejon ekzekutimin e kodit nga distanca me t\u00eb drejtat root.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OMI-\u0430\u0433\u0435\u043d\u0442\u0435, \u043d\u0430\u0432\u044f\u0437\u044b\u0432\u0430\u0435\u043c\u043e\u043c \u0432 Linux-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u0445 Microsoft Azure | ProHoster","og:description":"\u041a\u043b\u0438\u0435\u043d\u0442\u044b \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Microsoft Azure, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 Linux \u0432 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445, \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e (CVE-2021-38647), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-17T08:22:35+00:00","article:modified_time":"2021-09-17T08:22:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101307","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-17 08:49:36","updated":"2022-10-07 00:05:27","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/101307","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=101307"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/101307\/revisions"}],"predecessor-version":[{"id":172940,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/101307\/revisions\/172940"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=101307"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=101307"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=101307"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}