Microsoft Azure users running Linux VMs in the IT giant's Azure cloud need to take action to protect themselves against the four "OMIGOD" bugs in the Open Management Infrastructure (OMI) framework, because Microsoft hasn't raced to do it for them.

As The Register [1]outlined in our report on this month's Patch Tuesday release, Microsoft included fixes for [2]flaws security outfit Wiz spotted in Redmond's [3]open-source OMI agents. Wiz named the four flaws OMIGOD because they are astonishing.

The least severe of the flaws is rated 7/10 on the Common Vulnerability Scoring System. The worst is rated critical at 9.8/10.

[4]

Complicating matters is that running OMI is not something Azure users actively choose.

[5]

[6]

As Wiz explained: "When customers set up a Linux virtual machine in [Azure], the OMI agent is automatically deployed without their knowledge when they enable certain Azure services.

"Unless a patch is applied, attackers can easily exploit these four vulnerabilities to escalate to root privileges and remotely execute malicious code (for instance, encrypting files for ransom)."

[7]

Faced with that threat, it seems reasonable to expect that Microsoft would fix all the OMI agents it deploys and update VMs running vulnerable versions. That's the sort of thing cloud operators usually do – and do quietly before flaws are made public, so that attackers don't go to town.

Microsoft hasn't done so on this occasion. Indeed, the super-corp has kept deploying known bad versions of OMI when users create new Linux VMs.

[8]Microsoft's end-of-summer software security cleanse crushes more than 80 bugs

[9]Azure's now-fixed Cosmos DB flaw could have been exploited to read, write any database

[10]All your DNS were belong to us: AWS and Google Cloud shut down spying vulnerability

The Windows goliath's [11]latest advice , dated September 16, is: "Customers must update vulnerable extensions for their Cloud and On-Premises deployments as the updates become available per schedule outlined in table below."

Bad formatting means the table is wider than the section of Microsoft's web page, so rather a lot of lateral and vertical scrolling is required to learn that automatic updates have been enabled for six of the Azure services impacted by the bugs. But another seven services require manual updates. And even then, the automatic updates are a gradual rollout over the course of this month and not immediate.

It's on you to make sure you're running the latest OMI software in your Linux guests; a vulnerable build may have been injected into the virtual machine if you enabled certain services (see the aforementioned table.)

[12]

Understandably, Microsoft's actions – or lack thereof – have not gone down well.

They’ve also failed to update their own systems in Azure to install the patched version on new VM deployments. It’s honestly jaw dropping. — Kevin Beaumont (@GossiTheDog) [13]September 16, 2021

The Windows giant publicly fixed the holes in its OMI source [14]in mid-August , released it [15]last week , and only now is advising customers.

Researchers quickly found unpatched instances of OMI.

Security vendor Censys, for example, [16]wrote that it discovered "56 known exposed services worldwide that are likely vulnerable to this issue, including a major health organization and two major entertainment companies."

Happily, the biz also found "mass external exposure as seen with other hosts in the past (Microsoft Exchange comes to mind) does not appear to be present in this case."

In other words, there may not be that many vulnerable machines facing the public internet, or not many that are easily found. "The small footprint can be associated with nuances of how the OMI service responds, and that exposing OMI to the Internet likely requires deliberate effort," Censys noted.

Focus instead then will be on Microsoft's approach to patching and redeploying its open-source code.

That all said, the method needed to exploit the remote-code execution flaw is rather simple. We've already had sight of public proof-of-concept exploit code.

Sophos's [17]description of the flaw explains the peril:

Astonishingly, the bug seems to boil down to a laughably easy trick.

Rather than guessing a valid authentication token to insert into a fraudulent OMI web request, you simply omit all mention of the authentication token altogether, and you’re in!

Your next step is therefore obvious: patch ASAP. Because, as Censys puts it, "these issues would easily allow compromise with the highest-level privileges possible into any host which is running OMI." ®

Get our [18]Tech Resources



[1] https://www.theregister.com/2021/09/15/microsoft_patch_tuesday/

[2] https://www.wiz.io/blog/secret-agent-exposes-azure-customers-to-unauthorized-code-execution?s=09

[3] https://github.com/microsoft/omi

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YURnVCif0M1EfcA5lj5LdwAAAYU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YURnVCif0M1EfcA5lj5LdwAAAYU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YURnVCif0M1EfcA5lj5LdwAAAYU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YURnVCif0M1EfcA5lj5LdwAAAYU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[8] https://www.theregister.com/2021/09/15/microsoft_patch_tuesday/

[9] https://www.theregister.com/2021/08/27/chaos_db_azure_cosmos_flaw/

[10] https://www.theregister.com/2021/08/06/aws_google_dns/

[11] https://msrc-blog.microsoft.com/2021/09/16/additional-guidance-regarding-omi-vulnerabilities-within-azure-vm-management-extensions/

[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YURnVCif0M1EfcA5lj5LdwAAAYU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[13] https://twitter.com/GossiTheDog/status/1438637187717816323?ref_src=twsrc%5Etfw

[14] https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa

[15] https://github.com/microsoft/omi/releases/tag/v1.6.8-1

[16] https://censys.io/blog/understanding-the-impact-of-omigod-cve-2021-38647/

[17] https://nakedsecurity.sophos.com/2021/09/16/omigod-an-exploitable-hole-in-microsoft-open-source-code/

[18] https://whitepapers.theregister.com/