Open Management Infrastructure Elevation of Privilege Vulnerability
🔗 CVE IDs covered (1)
📋 Description
Update 9/16/2021: Where can I find more information about how to know if I'm protected and what steps can be taken to be protected? Please see Additional Guidance Regarding OMI Vulnerabilities within Azure VM Management Extensions for more information. What is OMI? Open Management Infrastructure (OMI) is an open source project to further the development of a production quality implementation of the DMTF CIM/WBEM standards. The OMI CIMOM is also designed to be portable and highly modular. In order to attain its small footprint, it is coded in C, which also makes it a much more viable CIM Object Manager for embedded systems and other infrastructure components that have memory constraints for their management processor. OMI is also designed to be inherently portable. It builds and runs today on most UNIX® systems and Linux. In addition to OMI's small footprint, it also demonstrates very high performance. Refer this link for more details : GitHub - microsoft/omi: Open Management Infrastructure How do I protect myself from this vulnerability? Please see Additional Guidance Regarding OMI Vulnerabilities within Azure VM Management Extensions for more information. The updates for this vulnerability were published on GitHub on August 11, 2021. Why is Microsoft just now releasing a CVE? The fix to address this vulnerability in open-source code was made available on August 11 to provide partners who depend on this software time to implement the updates before we released the details of the vulnerability.
🎯 Affected products10
- Azure Automation State Configuration, DSC Extension
- Azure Automation Update Management
- Azure Diagnostics (LAD)
- Azure Security Center
- Azure Sentinel
- Azure Stack Hub
- Container Monitoring Solution
- Log Analytics Agent
- Open Management Infrastructure
- System Center Operations Manager (SCOM)
✅ Remediation
KBRelease Notes (Security Update) — fixed build OMI Version 1.6.8-1 KBRelease Notes (Security Update) — fixed build OMI version: 1.6.8-1 KBRelease Notes (Security Update) — fixed build DSC Agent versions: 2.71.1.25, 2.70.0.30, 3.0.0.3 KBRelease Notes (Security Update) — fixed build OMS Agent for Linux GA v1.13.40-0 KBRelease Notes (Security Update) — fixed build LAD v4.0.13 and LAD v3.0.135 KBRelease Notes (Security Update) KBRelease Notes (Security Update) — fixed build Monitor, Update and Config Mgmnt 1.14.01 KBRelease Notes (Security Update) — fixed build 3.1.135
🔗 References (8)
- advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38648
- patchhttps://github.com/microsoft/omi-kits/tree/master/release
- referencehttps://github.com/microsoft/omi/releases/tag/v1.6.8-1
- referencehttps://github.com/microsoft/SCXcore-kits/tree/master/release
- referencehttps://docs.microsoft.com/en-us/azure/virtual-machines/extensions/diagnostics-linux?context=%2Fazure%2Fvirtual-machines%2Fcontext%2Fcontext&tabs=azcli
- referencehttps://github.com/microsoft/containerregistry
- referencehttps://docs.microsoft.com/en-us/azure-stack/operator/azure-stack-overview?view=azs-2102
- referencehttps://docs.microsoft.com/en-us/azure-stack/operator/azure-stack-download-azure-marketplace-item?view=azs-2102&tabs=az1%2Caz2&pivots=state-connected