Fixing Vulnerabilities

Scenario

If HSS detects a vulnerability on a server, you need to handle the vulnerability in a timely manner based on its severity and your business conditions to prevent further vulnerability exploits.

If a vulnerability may harm your services, fix it as soon as possible. For Linux and Windows vulnerabilities, you can go to the HSS console and fix them in one-click. Web-CMS vulnerabilities, emergency vulnerabilities, and application vulnerabilities cannot be automatically fixed. You can handle them by referring to the suggestions provided on the vulnerability details page.

Constraints and Limitations

• For details about vulnerability management in Host Security Service (HSS) editions, see Host Security Service User Guide.
• The following table describes the OSs that have reached their end of life (EOL). HSS does not support automatic vulnerability fixing on these OSs. You are advised to use the OSs in active support.

  Table 1 OSs that have reached EOS

  OS	Description
  CentOS 8	It has reached EOL and will no longer maintained. HSS scans them for vulnerabilities based on Red Hat patch notices, but cannot fix them due to the lack of official patches. You are advised to change to the OSs in active support.
  Ubuntu 18.04	Ubuntu 18.04 and earlier versions do not support free patch updates. You need to apply for and configure Ubuntu Pro to install upgrade packages, or vulnerability fix will fail.
  Debian 9 and 10	It has officially reached EOL. No official patches are available. You are advised to change to the OSs in active support.
  Windows 2012 R2	It has officially reached EOL. No official patches are available. You are advised to change to the OSs in active support.

• The kernel vulnerabilities on CCE, MRS, and BMS servers cannot be fixed. Fixing them may make some functions unavailable.
• To handle vulnerabilities on a server, ensure the server is in the Running state, its agent status is Online, and its protection status is Protected.

Precautions

• Vulnerability fixing operations cannot be rolled back. If a vulnerability fails to be fixed, services will probably be interrupted, and incompatibility issues will probably occur in middleware or upper layer applications. To prevent unexpected consequences, you are advised to use CBR to back up ECSs. Then, use idle servers to simulate the production environment and test-fix the vulnerability. If the test-fix succeeds, fix the vulnerability on servers running in the production environment.
• Servers need to access the Internet and use external image sources to fix vulnerabilities.

Fixing Vulnerabilities on the Console

Only Linux vulnerabilities and Windows vulnerabilities can be fixed using the repair function on the console.

1. Log in to the management console.
2. Click in the upper part of the page and choose Security > SecMaster.
3. In the navigation pane on the left, choose Workspaces > Management. In the workspace list, click the name of the target workspace.
4. In the navigation pane on the left, choose Risk Prevention > Vulnerabilities.
5. On the displayed page, click Linux Vulnerabilities or Windows Vulnerabilities.
6. In the vulnerability list, click the name of the target vulnerability. The vulnerability details page is displayed.
7. On the Vulnerability Details page, click Affected Resources. In the resource list, locate the row that contains the target resource and click Repair in the Operation column.

   To fix vulnerabilities in batches, select all the target vulnerabilities and click Batch Repair in the upper left corner above the list.

8. If a vulnerability is fixed, its status will change to Fixed. If it fails to be fixed, its status will change to Failed.
   

   Restart the system after you fixed a Linux kernel vulnerability, or the system will probably continue to warn you of this vulnerability.

Manually Fixing Software Vulnerabilities

One-click automatic fix of Web-CMS or application vulnerabilities is not supported. You can log in to the server to manually fix them by referring to the fix suggestions on the vulnerability details slide-out panel.

• Vulnerability Fixing Commands

  On the basic information page of vulnerabilities, you can fix a detected vulnerability based on the provided suggestions. For details about the vulnerability fixing commands, see Table 2.

  

  • Restart the system after you fixed a Windows or Linux kernel vulnerability, or the system will probably continue to warn you of this vulnerability.
  • Fix the vulnerabilities in sequence based on the suggestions.
  • If multiple software packages on the same server have the same vulnerability, you only need to fix the vulnerability once.

  Table 2 Vulnerability fix commands

  OS	Fix Command
  CentOS/Fedora/EulerOS/Red Hat/Oracle	yum update Software name
  Debian/Ubuntu	apt-get update && apt-get install Software name --only-upgrade
  Gentoo	See the vulnerability fix suggestions for details.

• Vulnerability Fixing Methods

  Vulnerability fixing may affect service stability. You are advised to use either of the following methods to avoid such impacts:

  • Method 1: Create a VM to fix the vulnerability.
    1. Create an image for the ECS host whose vulnerability needs to be fixed.
    2. Use the image to create an ECS.
    3. Fix the vulnerability on the new ECS and verify the result.
    4. Switch services over to the new ECS and verify they are stably running.
    5. Release the original ECS. If a fault occurs after the service switchover and cannot be rectified, you can switch services back to the original ECS.
  • Method 2: Fix the vulnerability on the current server.
    1. Create a backup for the ECS to be fixed.
    2. Fix vulnerabilities on the current server.
    3. If services become unavailable after the vulnerability is fixed and cannot be recovered in a timely manner, use the backup to restore the server.
  

  • Use method 1 if you are fixing a vulnerability for the first time and cannot estimate the impact on services.
  • Use method 2 if you have fixed the vulnerability on similar servers before.

Verifying Vulnerability Fix

After a vulnerability is fixed, you are advised to verify it immediately.