Using ASC to find machines affected by OMI vulnerabilities in Azure VM Management Extensions

This post has been republished via RSS; it originally appeared at: Microsoft Tech Community - Latest Blogs - .

Two weeks ago, Microsoft released fixes for three Elevation of Privilege (EoP) vulnerabilities and one unauthenticated Remote Code Execution (RCE) vulnerability in the Open Management Infrastructure (OMI) framework:  CVE-2021-38645, CVE-2021-38649, CVE-2021-38648, and CVE-2021-38647, respectively.   


OMI is an open-source Web-Based Enterprise Management (WBEM) implementation for managing Linux and UNIX systems. Several Azure Virtual Machine (VM) management extensions use this framework to orchestrate configuration management and log collection on Linux VMs. The remote code execution vulnerability, CVE-2021-38647, only impacts customers using a Linux management solution (on-premises SCOM or Azure Automation State Configuration or Azure Desired State Configuration extension) that enables remote OMI management.  


We’ve already released extensive guidance for how to resolve these issues, as well as how to protect against these vulnerabilities, and how to detect whether these vulnerabilities have been exploited. For full details see this post on the Microsoft Security Response Center (MSRC) blog.  


How can Azure Security Center help? 

Organizations using Azure Security Center who’ve also enabled the integrated threat protection plan, Azure Defender for servers, can take advantage of the built-in vulnerability scanner.  


The vulnerability scanner included with Azure Security Center is powered by Qualys. Qualys' scanner is one of the leading tools for real-time identification of vulnerabilities. Learn more in Azure Defender's integrated vulnerability assessment solution for Azure and hybrid machines


Using Security Center’s asset inventory page, you can quickly find all machines affected by any CVE with the fast-filtering tools, as shown in the video below.


Machines impacted by CVE-2021-38647.gif



When you’ve identified any affected machines in your subscriptions, download the fixed version of the relevant extension from the table in the MSRC blog post.

REMEMBER: these articles are REPUBLISHED. Your best bet to get a reply is to follow the link at the top of the post to the ORIGINAL post! BUT you're more than welcome to start discussions here:

This site uses Akismet to reduce spam. Learn how your comment data is processed.