{"id":101307,"date":"2021-09-17T10:22:35","date_gmt":"2021-09-17T08:22:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure"},"modified":"2021-09-17T10:22:35","modified_gmt":"2021-09-17T08:22:35","slug":"udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","title":{"rendered":"Fj\u00e4rrutnyttjad s\u00e5rbarhet i OMI-agenten som installeras i Linux-milj\u00f6er av Microsoft Azure","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kunder p\u00e5 Microsoft Azures molnplattform som anv\u00e4nder Linux i virtuella maskiner har st\u00f6tt p\u00e5 en kritisk s\u00e5rbarhet (CVE-2021-38647) som m\u00f6jligg\u00f6r fj\u00e4rrk\u00f6rning av kod med root-r\u00e4ttigheter. S\u00e5rbarheten har kodnamnet OMIGOD och \u00e4r anm\u00e4rkningsv\u00e4rd eftersom problemet finns i applikationen OMI Agent, som diskret installeras i Linux-milj\u00f6er. <\/p>\n

OMI Agent installeras automatiskt och aktiveras n\u00e4r tj\u00e4nster som Azure Automation, Azure Automatic Update, Azure Operations Management Suite, Azure Log Analytics, Azure Configuration Management, Azure Diagnostics och Azure Container Insights anv\u00e4nds. Till exempel \u00e4r Linux-milj\u00f6erna i Azure med aktiverad \u00f6vervakning utsatta f\u00f6r angrepp. Agenten \u00e4r en del av det \u00f6ppna paketet OMI (Open Management Infrastructure Agent) med en implementation av stacket DMTF CIM\/WBEM f\u00f6r att hantera IT-infrastruktur. <\/p>\n

OMI Agent installeras i systemet under anv\u00e4ndaren omsagent och skapar inst\u00e4llningar i \/etc\/sudoers f\u00f6r att k\u00f6ra en serie skript med root-r\u00e4ttigheter. Under drift av vissa tj\u00e4nster skapas lyssnande n\u00e4tverks-sockets p\u00e5 n\u00e4tverksportarna 5985, 5986 och 1270. Skanning med tj\u00e4nsten Shodan visar att mer \u00e4n 15 000 s\u00e5rbara Linux-milj\u00f6er finns p\u00e5 n\u00e4tet. F\u00f6r n\u00e4rvarande finns det redan en fungerande prototyp av en exploit tillg\u00e4nglig som m\u00f6jligg\u00f6r k\u00f6rning av egen kod med root-r\u00e4ttigheter p\u00e5 s\u00e5dana system. <\/p>\n

Problemet f\u00f6rv\u00e4rras av att anv\u00e4ndningen av OMI och OMI Agent i Azure tydligt inte \u00e4r dokumenterat, och OMI Agent installeras utan varning \u2014 det r\u00e4cker med att acceptera villkoren f\u00f6r den valda tj\u00e4nsten n\u00e4r man konfigurerar milj\u00f6n, och OMI Agent aktiveras automatiskt, vilket inneb\u00e4r att de flesta anv\u00e4ndare inte ens misst\u00e4nker dess n\u00e4rvaro. <\/p>\n

Metoden f\u00f6r utnyttjande \u00e4r trivial \u2014 det r\u00e4cker med att skicka en XML-f\u00f6rfr\u00e5gan till agenten, genom att ta bort autentiseringhuvudet. OMI anv\u00e4nder autentisering n\u00e4r det tar emot kontrollmeddelanden och kontrollerar att klienten har r\u00e4tt att skicka viss kommandon. K\u00e4rnan i s\u00e5rbarheten \u00e4r att n\u00e4r autentiseringhuvudet \"Authentication\" tas bort i meddelandet, server<\/a> betraktas autentiseringstestet som framg\u00e5ngsrikt, mottar kontrollmeddelandet och till\u00e5ter exekvering av kommandon med root-r\u00e4ttigheter. F\u00f6r att utf\u00f6ra godtyckliga kommandon p\u00e5 systemet r\u00e4cker det med att anv\u00e4nda det inbyggda kommandot ExecuteShellCommand_INPUT i meddelandet. Till exempel, f\u00f6r att k\u00f6ra verktyget \"id\" r\u00e4cker det med att skicka en f\u00f6rfr\u00e5gan: curl -H \"Content-Type: application\/soap+xml;charset=UTF-8\" -k \u2014data-binary \"@http_body.txt\" https:\/\/10.0.0.5:5986\/wsman \u2026

id<\/p>

0<\/p> <\/p> <\/s> <\/s> <\/p>\n

Microsoft har redan sl\u00e4ppt en uppdatering av OMI 1.6.8.1 som \u00e5tg\u00e4rdar s\u00e5rbarheten, men den har \u00e4nnu inte distribuerats till anv\u00e4ndarna av Microsoft Azure (i nya milj\u00f6er installeras fortfarande den gamla versionen av OMI). Automatisk uppdatering av agenten st\u00f6ds inte, s\u00e5 anv\u00e4ndarna m\u00e5ste manuellt uppdatera paketet med kommandon \"dpkg -l omi\" i Debian\/Ubuntu eller \"rpm -qa omi\" i Fedora\/RHEL. Som en tillf\u00e4llig skydds\u00e5tg\u00e4rd rekommenderas att blockera \u00e5tkomst till n\u00e4tverksportarna 5985, 5986 och 1270. <\/p>\n

F\u00f6rutom CVE-2021-38647 har OMI 1.6.8.1 ocks\u00e5 \u00e5tg\u00e4rdat tre s\u00e5rbarheter (CVE-2021-38648, CVE-2021-38645 och CVE-2021-38649) som g\u00f6r det m\u00f6jligt f\u00f6r en icke-privilegerad lokal anv\u00e4ndare att k\u00f6ra sin kod med root-r\u00e4ttigheter.
\n
K\u00e4lla: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043b\u0438\u0435\u043d\u0442\u044b \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Microsoft Azure, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 Linux \u0432 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445, \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e (CVE-2021-38647), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u043a\u043e\u0434\u043e\u0432\u043e\u0435 \u0438\u043c\u044f OMIGOD \u0438 \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0438 OMI Agent, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0431\u0435\u0437 \u043b\u0438\u0448\u043d\u0435\u0439 \u043e\u0433\u043b\u0430\u0441\u043a\u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0432 Linux-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. OMI Agent \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0438 \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0442\u0430\u043a\u0438\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432, \u043a\u0430\u043a […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-101307","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Fj\u00e4rrutnyttjad s\u00e5rbarhet i OMI-agenten, p\u00e5tvingad i Linux-milj\u00f6er p\u00e5 Microsoft Azure | ProHoster","description":"Kunder p\u00e5 Microsoft Azures molnplattform som anv\u00e4nder Linux i virtuella maskiner har st\u00f6tt p\u00e5 en kritisk s\u00e5rbarhet (CVE-2021-38647) som g\u00f6r det m\u00f6jligt att k\u00f6ra kod med root-r\u00e4ttigheter p\u00e5 distans.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 OMI-\u0430\u0433\u0435\u043d\u0442\u0435, \u043d\u0430\u0432\u044f\u0437\u044b\u0432\u0430\u0435\u043c\u043e\u043c \u0432 Linux-\u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u0445 Microsoft Azure | ProHoster","og:description":"\u041a\u043b\u0438\u0435\u043d\u0442\u044b \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b Microsoft Azure, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 Linux \u0432 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u043c\u0430\u0448\u0438\u043d\u0430\u0445, \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u043b\u0438\u0441\u044c \u0441 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e (CVE-2021-38647), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/udalyonno-ekspluatiruemaya-uyazvimost-v-omi-agente-navyazyvaemom-v-linux-okruzheniyah-microsoft-azure","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-09-17T08:22:35+00:00","article:modified_time":"2021-09-17T08:22:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"101307","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-09-17 08:49:36","updated":"2022-10-07 00:05:27","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/101307","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=101307"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/101307\/revisions"}],"predecessor-version":[{"id":172940,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/101307\/revisions\/172940"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=101307"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=101307"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=101307"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}