(Updated, September 17)
On September 16, 2021, Microsoft released additional guidance on Open Management Infrastructure (OMI) vulnerabilities—CVE-2021-38645, CVE-2021-38649, CVE-2021-38648, and CVE-2021-38647—which impact Azure VM Management Extensions. According to Microsoft, “[c]ustomers must update vulnerable extensions for their Cloud and On-Premises deployments as the updates become available…”
CISA encourages organizations to review Additional Guidance Regarding OMI Vulnerabilities within Azure VM Management Extensions for more information and to:
(Original, September 16)
Microsoft has released an update to address a remote code execution vulnerability—CVE-2021-38647—in Azure Linux Open Management Infrastructure (OMI). An attacker could use this vulnerability to take control of an affected system.
CISA encourages users and administrators to review the Microsoft Security Advisory to apply the necessary update.
This product is provided subject to this Notification and this Privacy & Use policy.
Please share your thoughts.
We recently updated our anonymous product survey; we’d welcome your feedback.
msrc-blog.microsoft.com/2021/09/16/additional-guidance-regarding-omi-vulnerabilities-within-azure-vm-management-extensions/
msrc-blog.microsoft.com/2021/09/16/additional-guidance-regarding-omi-vulnerabilities-within-azure-vm-management-extensions/
msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38645
msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38647
msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38647
msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38647
msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38648
msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38649