Thank you Aris for reaching out with questions on these new vulnerabilities!
New OMI vulnerabilities for SCOM/Log Analytics Agents posted. The vulnerabilities apply to OMI component on non-windows servers with SCOM2019, SCOM2022, or Log Analytics agents. The vulnerabilities apply to non-windows server operating systems. See hotfix details below to resolve.
OMI vulnerabilities for SCOM/LogAnalytics CVE details
CVE-2024-21134 https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-21334
The vulnerability exists due to a use-after-free error in the Open Management Infrastructure (OMI). A remote attacker can execute arbitrary code on the target system.
CVE-2024-21330 https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21330
The vulnerability exists due to application does not properly impose security restrictions in the Open Management Infrastructure (OMI), which leads to security restrictions bypass and privilege escalation.
SCOM Download links
2019 https://www.microsoft.com/en-us/download/details.aspx?id=58208
2022 https://www.microsoft.com/en-in/download/details.aspx?id=104213
Update OMI on for SCOM/Log Analytics agents
Leverage Holman’s Monitoring UNIX quick start guide(s) if you need a ‘how to’ or refresher to update your SCOM management groups with the latest packs, and how to update the agent on non-windows/UNIX servers.
SCOM2022 https://kevinholman.com/2022/12/12/monitoring-unix-linux-with-scom-2022/
SCOM2016,2019 https://kevinholman.com/2016/11/11/monitoring-unix-linux-with-opsmgr-2016/