Threat actors started actively exploiting the critical Azure OMIGOD vulnerabilities two days after Microsoft disclosed them during this month’s Patch Tuesday.
The four security flaws were found in the Open Management Infrastructure software agent silently installed by Microsoft on more than half of all Azure instances.
According to GreyNoise’s current stats, attackers are scanning the Internet for exposed Azure Linux VMs vulnerable to CVE-2021-38647 exploits from over 110 servers.
A Mirai botnet is behind some of these exploitation attempts targeting Azure Linux OMI endpoints vulnerable to CVE-2021-38647 RCE exploits, as first spotted by Fernández on Thursday evening.
How to secure your Azure VM. While Microsoft has released patched a patched OMI software agent version more than a week ago, the company is still in the process of rolling out security updates to cloud customers who have automatic updates enabled in their VMs. According to additional guidance Redmond released today, “Customers must update vulnerable extensions for their Cloud and On-Premises deployments as the updates become available” per a predefined schedule shared by the Microsoft Security Response Center team.
“While updates are being rolled out using safe deployment practices, customers can protect against the RCE vulnerability by ensuring VMs are deployed within a Network Security Group or behind a perimeter firewall and restrict access to Linux systems that expose the OMI ports,” Microsoft added.
