{"id":3761,"date":"2021-09-20T11:19:30","date_gmt":"2021-09-20T16:19:30","guid":{"rendered":"https:\/\/truxgoservers.com\/blog\/?p=3761"},"modified":"2021-09-20T11:24:59","modified_gmt":"2021-09-20T16:24:59","slug":"omigod-threat-attacking-azure-linux-virtual-machines","status":"publish","type":"post","link":"https:\/\/truxgoservers.com\/blog\/omigod-threat-attacking-azure-linux-virtual-machines\/","title":{"rendered":"OMIGOD – Threat attacking azure linux virtual machines"},"content":{"rendered":"\n

On September 14, Wiz researchers disclosed a set of four vulnerabilities in Microsoft’s Open Management Infrastructure (OMI), an open source Common Information Model (CIM) management server used to manage Unix and Linux systems. These flaws were referred to as “OMIGOD” and are found within the OMI agents that are installed on Microsoft’s Azure Linux virtual machines by default. These agents can be found in various Azure-based services<\/a>, including:<\/p>\n\n\n\n

\u25b8Azure automation<\/em><\/strong><\/p>\n\n\n\n

\u25b8Azure configuration management<\/em><\/strong><\/p>\n\n\n\n

\u25b8Azure Operations Management Pack<\/em><\/strong><\/p>\n\n\n\n

\u25b8Azure Container Insights<\/em><\/strong><\/p>\n\n\n\n

\u25b8Azure Diagnostics<\/em><\/strong><\/p>\n\n\n\n

\u25b8Azure automatic update<\/em><\/strong><\/p>\n\n\n\n

\u25b8Azure log analysis<\/em><\/strong><\/p>\n\n\n\n

The big problem that this threat can present is real and although the software called Open Management Infrastructure (OMI) is little known, it can be implemented automatically, without the knowledge of the customers, when they configure a Linux virtual machine in the cloud, unless After a patch is applied, attackers can easily exploit all four OMIGOD vulnerabilities to escalate to root privileges and remotely execute malicious code.<\/p>\n\n\n\n

The Wiz researchers describe the flaw as a “textbook RCE vulnerability” that one would expect to see in the 1990s, noting that it is highly unusual for one to emerge in 2021. “With a single packet, an attacker can become root on a remote machine simply by removing the authentication header. Any request without an authorization header has its default privileges uid = 0, gid = 0, which is root”.<\/p>\n\n\n\n

At least 15,000 Azure servers remain exploitable, according to Horizon3.a1, a security company established in 2019 by veterans of the US defense forces.In addition, Microsoft confirms that all versions of Azure Linux IMO below v1 .6.8-1 are vulnerable to this RCE vulnerability, but classify CVE-2021-38647 as “less likely” to be exploited, but don’t be fooled, either less likely is still a threat plus there are 3 more vulnerabilities that can be easily exploited and it is up to you to be protected against it.<\/p>\n\n\n\n

Related reads:
Cloud Service Vulnerabilities that you shouldn\u2019t Forget<\/a>
Windows 10 vulnerabilities that have been highlighted<\/a>
New vulnerability that Ubuntu is facing<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

On September 14, Wiz researchers disclosed a set of four vulnerabilities in Microsoft’s Open Management Infrastructure (OMI), an open source Common Information Model (CIM) management server used to manage Unix and Linux systems. These flaws were referred to as “OMIGOD” and are found within the OMI agents that are installed on Microsoft’s Azure Linux virtual […]<\/p>\n","protected":false},"author":1,"featured_media":3762,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[36],"class_list":["post-3761","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-cybersecurity"],"yoast_head":"\nOMIGOD - Threat attacking azure linux virtual machines - Truxgo Server Blog<\/title>\n<meta name=\"description\" content=\"Today we will see a threat called OMIGOD that attacks Microsoft Azure users who run Linux virtual machines in the Azure cloud.........\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/truxgoservers.com\/blog\/omigod-threat-attacking-azure-linux-virtual-machines\/\" \/>\n<meta property=\"og:locale\" content=\"es_MX\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"OMIGOD - Threat attacking azure linux virtual machines - Truxgo Server Blog\" \/>\n<meta property=\"og:description\" content=\"Today we will see a threat called OMIGOD that attacks Microsoft Azure users who run Linux virtual machines in the Azure cloud.........\" \/>\n<meta property=\"og:url\" content=\"https:\/\/truxgoservers.com\/blog\/omigod-threat-attacking-azure-linux-virtual-machines\/\" \/>\n<meta property=\"og:site_name\" content=\"Truxgo Server Blog\" \/>\n<meta property=\"article:published_time\" content=\"2021-09-20T16:19:30+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2021-09-20T16:24:59+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/truxgoservers.com\/blog\/wp-content\/uploads\/2021\/09\/OMI.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"450\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Truxgo\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Escrito por\" \/>\n\t<meta name=\"twitter:data1\" content=\"Truxgo\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tiempo de lectura\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutos\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/omigod-threat-attacking-azure-linux-virtual-machines\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/omigod-threat-attacking-azure-linux-virtual-machines\\\/\"},\"author\":{\"name\":\"Truxgo\",\"@id\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/#\\\/schema\\\/person\\\/8b409c26449db6aa09724b45331e333e\"},\"headline\":\"OMIGOD – Threat attacking azure linux virtual machines\",\"datePublished\":\"2021-09-20T16:19:30+00:00\",\"dateModified\":\"2021-09-20T16:24:59+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/omigod-threat-attacking-azure-linux-virtual-machines\\\/\"},\"wordCount\":336,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/omigod-threat-attacking-azure-linux-virtual-machines\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/09\\\/OMI.jpg\",\"keywords\":[\"Cybersecurity\"],\"articleSection\":[\"Cybersecurity\"],\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/omigod-threat-attacking-azure-linux-virtual-machines\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/omigod-threat-attacking-azure-linux-virtual-machines\\\/\",\"url\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/omigod-threat-attacking-azure-linux-virtual-machines\\\/\",\"name\":\"OMIGOD - Threat attacking azure linux virtual machines - Truxgo Server Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/omigod-threat-attacking-azure-linux-virtual-machines\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/omigod-threat-attacking-azure-linux-virtual-machines\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/09\\\/OMI.jpg\",\"datePublished\":\"2021-09-20T16:19:30+00:00\",\"dateModified\":\"2021-09-20T16:24:59+00:00\",\"description\":\"Today we will see a threat called OMIGOD that attacks Microsoft Azure users who run Linux virtual machines in the Azure cloud.........\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/omigod-threat-attacking-azure-linux-virtual-machines\\\/#breadcrumb\"},\"inLanguage\":\"es\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/omigod-threat-attacking-azure-linux-virtual-machines\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/omigod-threat-attacking-azure-linux-virtual-machines\\\/#primaryimage\",\"url\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/09\\\/OMI.jpg\",\"contentUrl\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/09\\\/OMI.jpg\",\"width\":800,\"height\":450},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/omigod-threat-attacking-azure-linux-virtual-machines\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"OMIGOD – Threat attacking azure linux virtual machines\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/\",\"name\":\"Truxgo Server Blog\",\"description\":\"Cloud Server and Hosting Tutorials.\",\"publisher\":{\"@id\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"es\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/#organization\",\"name\":\"Truxgo Server Blog\",\"url\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/cropped-truxgo-logo-blanco.png\",\"contentUrl\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/cropped-truxgo-logo-blanco.png\",\"width\":1250,\"height\":278,\"caption\":\"Truxgo Server Blog\"},\"image\":{\"@id\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/#\\\/schema\\\/person\\\/8b409c26449db6aa09724b45331e333e\",\"name\":\"Truxgo\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"es\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/52691a61c58e68677ed4860007c1bb03b14eabe7350747ab3fad3e17825b4b96?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/52691a61c58e68677ed4860007c1bb03b14eabe7350747ab3fad3e17825b4b96?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/52691a61c58e68677ed4860007c1bb03b14eabe7350747ab3fad3e17825b4b96?s=96&d=mm&r=g\",\"caption\":\"Truxgo\"},\"sameAs\":[\"https:\\\/\\\/truxgoservers.com\\\/blog\"],\"url\":\"https:\\\/\\\/truxgoservers.com\\\/blog\\\/author\\\/truxgo\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"OMIGOD - Threat attacking azure linux virtual machines - Truxgo Server Blog","description":"Today we will see a threat called OMIGOD that attacks Microsoft Azure users who run Linux virtual machines in the Azure cloud.........","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/truxgoservers.com\/blog\/omigod-threat-attacking-azure-linux-virtual-machines\/","og_locale":"es_MX","og_type":"article","og_title":"OMIGOD - Threat attacking azure linux virtual machines - Truxgo Server Blog","og_description":"Today we will see a threat called OMIGOD that attacks Microsoft Azure users who run Linux virtual machines in the Azure cloud.........","og_url":"https:\/\/truxgoservers.com\/blog\/omigod-threat-attacking-azure-linux-virtual-machines\/","og_site_name":"Truxgo Server Blog","article_published_time":"2021-09-20T16:19:30+00:00","article_modified_time":"2021-09-20T16:24:59+00:00","og_image":[{"width":800,"height":450,"url":"https:\/\/truxgoservers.com\/blog\/wp-content\/uploads\/2021\/09\/OMI.jpg","type":"image\/jpeg"}],"author":"Truxgo","twitter_card":"summary_large_image","twitter_misc":{"Escrito por":"Truxgo","Tiempo de lectura":"2 minutos"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/truxgoservers.com\/blog\/omigod-threat-attacking-azure-linux-virtual-machines\/#article","isPartOf":{"@id":"https:\/\/truxgoservers.com\/blog\/omigod-threat-attacking-azure-linux-virtual-machines\/"},"author":{"name":"Truxgo","@id":"https:\/\/truxgoservers.com\/blog\/#\/schema\/person\/8b409c26449db6aa09724b45331e333e"},"headline":"OMIGOD – Threat attacking azure linux virtual machines","datePublished":"2021-09-20T16:19:30+00:00","dateModified":"2021-09-20T16:24:59+00:00","mainEntityOfPage":{"@id":"https:\/\/truxgoservers.com\/blog\/omigod-threat-attacking-azure-linux-virtual-machines\/"},"wordCount":336,"commentCount":0,"publisher":{"@id":"https:\/\/truxgoservers.com\/blog\/#organization"},"image":{"@id":"https:\/\/truxgoservers.com\/blog\/omigod-threat-attacking-azure-linux-virtual-machines\/#primaryimage"},"thumbnailUrl":"https:\/\/truxgoservers.com\/blog\/wp-content\/uploads\/2021\/09\/OMI.jpg","keywords":["Cybersecurity"],"articleSection":["Cybersecurity"],"inLanguage":"es","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/truxgoservers.com\/blog\/omigod-threat-attacking-azure-linux-virtual-machines\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/truxgoservers.com\/blog\/omigod-threat-attacking-azure-linux-virtual-machines\/","url":"https:\/\/truxgoservers.com\/blog\/omigod-threat-attacking-azure-linux-virtual-machines\/","name":"OMIGOD - Threat attacking azure linux virtual machines - Truxgo Server Blog","isPartOf":{"@id":"https:\/\/truxgoservers.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/truxgoservers.com\/blog\/omigod-threat-attacking-azure-linux-virtual-machines\/#primaryimage"},"image":{"@id":"https:\/\/truxgoservers.com\/blog\/omigod-threat-attacking-azure-linux-virtual-machines\/#primaryimage"},"thumbnailUrl":"https:\/\/truxgoservers.com\/blog\/wp-content\/uploads\/2021\/09\/OMI.jpg","datePublished":"2021-09-20T16:19:30+00:00","dateModified":"2021-09-20T16:24:59+00:00","description":"Today we will see a threat called OMIGOD that attacks Microsoft Azure users who run Linux virtual machines in the Azure cloud.........","breadcrumb":{"@id":"https:\/\/truxgoservers.com\/blog\/omigod-threat-attacking-azure-linux-virtual-machines\/#breadcrumb"},"inLanguage":"es","potentialAction":[{"@type":"ReadAction","target":["https:\/\/truxgoservers.com\/blog\/omigod-threat-attacking-azure-linux-virtual-machines\/"]}]},{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/truxgoservers.com\/blog\/omigod-threat-attacking-azure-linux-virtual-machines\/#primaryimage","url":"https:\/\/truxgoservers.com\/blog\/wp-content\/uploads\/2021\/09\/OMI.jpg","contentUrl":"https:\/\/truxgoservers.com\/blog\/wp-content\/uploads\/2021\/09\/OMI.jpg","width":800,"height":450},{"@type":"BreadcrumbList","@id":"https:\/\/truxgoservers.com\/blog\/omigod-threat-attacking-azure-linux-virtual-machines\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/truxgoservers.com\/blog\/"},{"@type":"ListItem","position":2,"name":"OMIGOD – Threat attacking azure linux virtual machines"}]},{"@type":"WebSite","@id":"https:\/\/truxgoservers.com\/blog\/#website","url":"https:\/\/truxgoservers.com\/blog\/","name":"Truxgo Server Blog","description":"Cloud Server and Hosting Tutorials.","publisher":{"@id":"https:\/\/truxgoservers.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/truxgoservers.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"es"},{"@type":"Organization","@id":"https:\/\/truxgoservers.com\/blog\/#organization","name":"Truxgo Server Blog","url":"https:\/\/truxgoservers.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/truxgoservers.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/truxgoservers.com\/blog\/wp-content\/uploads\/2020\/08\/cropped-truxgo-logo-blanco.png","contentUrl":"https:\/\/truxgoservers.com\/blog\/wp-content\/uploads\/2020\/08\/cropped-truxgo-logo-blanco.png","width":1250,"height":278,"caption":"Truxgo Server Blog"},"image":{"@id":"https:\/\/truxgoservers.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/truxgoservers.com\/blog\/#\/schema\/person\/8b409c26449db6aa09724b45331e333e","name":"Truxgo","image":{"@type":"ImageObject","inLanguage":"es","@id":"https:\/\/secure.gravatar.com\/avatar\/52691a61c58e68677ed4860007c1bb03b14eabe7350747ab3fad3e17825b4b96?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/52691a61c58e68677ed4860007c1bb03b14eabe7350747ab3fad3e17825b4b96?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/52691a61c58e68677ed4860007c1bb03b14eabe7350747ab3fad3e17825b4b96?s=96&d=mm&r=g","caption":"Truxgo"},"sameAs":["https:\/\/truxgoservers.com\/blog"],"url":"https:\/\/truxgoservers.com\/blog\/author\/truxgo\/"}]}},"_links":{"self":[{"href":"https:\/\/truxgoservers.com\/blog\/wp-json\/wp\/v2\/posts\/3761","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/truxgoservers.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/truxgoservers.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/truxgoservers.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/truxgoservers.com\/blog\/wp-json\/wp\/v2\/comments?post=3761"}],"version-history":[{"count":3,"href":"https:\/\/truxgoservers.com\/blog\/wp-json\/wp\/v2\/posts\/3761\/revisions"}],"predecessor-version":[{"id":3776,"href":"https:\/\/truxgoservers.com\/blog\/wp-json\/wp\/v2\/posts\/3761\/revisions\/3776"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/truxgoservers.com\/blog\/wp-json\/wp\/v2\/media\/3762"}],"wp:attachment":[{"href":"https:\/\/truxgoservers.com\/blog\/wp-json\/wp\/v2\/media?parent=3761"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/truxgoservers.com\/blog\/wp-json\/wp\/v2\/categories?post=3761"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/truxgoservers.com\/blog\/wp-json\/wp\/v2\/tags?post=3761"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}