cyber.hendryadrian.com
Security News · wiz.io

Azure Adds Opt-In Automatic Updates for Three Agents That Include OMI

· Original article ↗

Summary

Azure added opt-in automatic updates for its OMS, Azure Diagnostics and Desired State Configuration agents, which also update OMI. The change follows Wiz’s research into CVE-2022-29149 and gaps in detecting and patching affected instances.

Key points

  • CVE-2022-29149 is a local privilege escalation vulnerability in OMI, patched by Microsoft in June 2022.
  • Wiz developed a proof-of-concept exploit and reported difficulties detecting vulnerable instances and manually updating OMI-dependent agents.
  • Wiz reported low patch rates in a sample of Azure enterprise environments, which it attributed in part to customers’ limited awareness and unclear update instructions.
  • Azure onboarded the OMS, Azure Diagnostics and Desired State Configuration agents to its opt-in Automatic Extension Upgrade capability; updating these agents also updates OMI installed with them.
  • Microsoft updated its advisory with more details about the vulnerability, affected services and remediation, and notified affected customers through Azure Service Health Notifications.
  • Wiz recommends enabling automatic updates for the three agents and encourages customers to migrate to Azure Monitoring Agent, which does not rely on OMI.

Article Details

Event Type
Microsoft added the OMS, Azure Diagnostics (LAD), and Desired State Configuration (DSC) agents that depend on OMI to the opt-in Automatic Extension Upgrade capability, following collaboration with Wiz on vulnerability detection and remediation.
Impact
Automatic updates can also update OMI installed with these agents, reducing the risk of vulnerable cloud middleware remaining unpatched. The article reports that Wiz developed an exploit proof of concept for CVE-2022-29149, a local privilege escalation vulnerability in OMI, and observed low patch rates in a sample of Azure enterprise environments. Azure updated its advisory on July 7, 2022, with additional vulnerability, affected-service, and remediation details and notified affected customers.

CVE

CVE-2021-38647Wiz Research found and reported the previous four vulnerabilities in OMI in June 2021, including an unauthenticated remote code execution vulnerability dubbed “OMIGOD” (CVE-2021-38647).CVE-2022-29149install them. Recently, as part of Microsoft’s June 2022 Patch Tuesday, an update was included to fix CVE-2022-29149, a new local privilege escalation vulnerability in OMI.

Vendors

MicrosoftAs new vulnerabilities are discovered in cloud middleware software such as Microsoft OMI (Open Management Infrastructure), used by multiple popular Azure services (Azure Automation, Azure Log analytics Azure SentinelWizIn the past year, Wiz Research has shed light on cloud middleware, software that brokers between customer workloads and cloud providers’ managed services. The task of updating middleware software is not well defined by

Products

Automatic Extension UpgradeState Configuration (DSC) agent and Azure Diagnostics (LAD) agent are now onboarded on to the Automatic Extension Upgrade capability, that will enable cloud customers to opt-in to automatic updates for these agents.Azuremiddleware software such as Microsoft OMI (Open Management Infrastructure), used by multiple popular Azure services (Azure Automation, Azure Log analytics Azure Sentinel and more), vendors release patches andAzure Automationsuch as Microsoft OMI (Open Management Infrastructure), used by multiple popular Azure services (Azure Automation, Azure Log analytics Azure Sentinel and more), vendors release patches and customers are required toAzure Diagnostics (LAD) agentAzure’s Operations Management Suite (OMS) agent, Desired State Configuration (DSC) agent and Azure Diagnostics (LAD) agent are now onboarded on to the Automatic Extension Upgrade capability, that will enable cloudAzure Log AnalyticsOMI (Open Management Infrastructure), used by multiple popular Azure services (Azure Automation, Azure Log analytics Azure Sentinel and more), vendors release patches and customers are required to manually installAzure Monitoring AgentAzure Diagnostics and Desired State Configuration agents and encourage customers to migrate to Azure Monitoring Agent, which does not rely on OMI. Automatic Extension Upgrade will ensure that Azure customers get anyAzure Open Management Infrastructure (OMI)As new vulnerabilities are discovered in cloud middleware software such as Microsoft OMI (Open Management Infrastructure), used by multiple popular Azure services (Azure Automation, Azure Log analytics Azure SentinelDesired State Configuration (DSC) agentof updates to 3 OMI dependent agents; Azure’s Operations Management Suite (OMS) agent, Desired State Configuration (DSC) agent and Azure Diagnostics (LAD) agent are now onboarded on to the Automatic Extension UpgradeMicrosoft SentinelInfrastructure), used by multiple popular Azure services (Azure Automation, Azure Log analytics Azure Sentinel and more), vendors release patches and customers are required to manually install them. Recently, as

Related Articles