PT-2021-2279 · Microsoft · Azure Virtual Machine+5

Paul Litvak + 1 · Published 2021-03-09 · Updated 2023-12-29 · CVE-2021-27075

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Azure Virtual Machine versions (affected versions not specified) Azure Container Instance versions (affected versions not specified) Azure Service Fabric versions (affected versions not specified) Azure Kubernetes Service versions (affected versions not specified) Azure Container Registry versions (affected versions not specified) Azure Spring Cloud versions (affected versions not specified)

Description The issue is related to a lack of protection for service data, which can be exploited by a remote attacker to gain unauthorized access to protected information. This can lead to information disclosure. There is also a mention of a Linux Azure VM Plugin System vulnerability that can lead to privilege escalation.

Recommendations For Azure Virtual Machine, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Azure Container Instance, consider restricting access to sensitive data until a patch is available. For Azure Service Fabric, as a temporary workaround, consider disabling any vulnerable plugins or modules until a fix is released. For Azure Kubernetes Service, restrict access to the vulnerable API endpoints until the issue is resolved. For Azure Container Registry, avoid using sensitive parameters in the affected API endpoints until the issue is fixed. For Azure Spring Cloud, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2021-01362

CVE-2021-27075

Affected Products

Azure Container Instance

Azure Container Registry

Azure Kubernetes Service

Azure Service Fabric

Azure Spring Cloud

Azure Virtual Machine

References · 9

• https://bdu.fstec.ru/vul/2021-01362 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27075 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27075 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27075 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27075 · Security Note
• https://cybersecurity-help.cz/vdb/SB2021030955 · Note
• https://t.me/cvenotify/11429 · Telegram Post
• https://t.me/cvenotify/11780 · Telegram Post
• https://t.me/secharvester/10992 · Telegram Post