Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 515
Alerts This Week
Warning Icon 1 515

Azure Linux VMs: Critical Update, Remote Code Exploit Affects Millions

Calendar Sep 15, 2021 • User Avatar Brittany Day
1 min read
32.Lock Code Circular Esm H446
Topics%20covered

Topics Covered

security advisory critical remote code execution exploit Azure Linux VMs Open Management Infrastructure

Azure users running Linux VMs may not be aware they have a severely vulnerable piece of management software installed on their machine by Microsoft, which can be remotely exploited in an incredibly surprising and equally stupid way. "This is a textbook RCE vulnerability that you would expect to see in the 90's -- it's highly unusual to have one crop up in 2021 that can expose millions of endpoints," Wiz security researcher Nir Ohfeld wrote.

As detailed by Wiz.io, which found four vulnerabilities in Microsoft's Open Management Infrastructure project, an attacker would be able to gain root access on a remote machine if they sent a single packet with the authentication header removed.