Handling Vulnerabilities

You can only fix Linux and Windows vulnerabilities with one-click on the console.

A maximum of 1,000 server vulnerabilities can be fixed at a time. If there are more than 1,000 vulnerabilities, fix them in batches.

1. Log in to the management console.
2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > HSS.
3. In the navigation pane, choose Risk Management > Vulnerabilities.
4. Fix Linux and Windows vulnerabilities.
   • Fixing a single vulnerability

     Locate the row containing a target vulnerability and click Fix in the Operation column.

     Figure 1 Fixing a single vulnerability
     
   • Fixing multiple vulnerabilities

     Select all target vulnerabilities and click Fix in the upper left corner of the vulnerability list to fix vulnerabilities in batches.

     Figure 2 Fixing multiple vulnerabilities
     
   • Fix all vulnerabilities.

     Click Fix in the upper left corner of the vulnerability list to fix all vulnerabilities.

     Figure 3 Fixing all vulnerabilities
     
   • Fix one or more servers affected by a vulnerability.
     1. Click a vulnerability name.
     2. On the vulnerability details slide-out panel displayed, click the Affected tab, locate the row containing the target server, and click Fix in the Operation column.

        You can also select all target servers and click Fix above the server list to fix vulnerabilities for the servers in batches.

        Figure 4 Fix a server affected by a vulnerability
        

5. In the displayed dialog box, confirm the number of vulnerabilities to be fixed and the number of affected assets.

   For Linux vulnerabilities, you can click View details in the Fix dialog box to view the name of the component to be fixed.

6. (Optional) Back up servers.
   Before fixing vulnerabilities, use HSS to back up servers, so that you can restore their data if it is affected by the fix. If you do not need to back up data, skip this step.

   1. In the Fix dialog box, click to enable backup.
      

      • After backup is enabled, the number of servers that can be backed up will be displayed below the toggle switch. Only the servers associated with backup vaults can be backed up. For more information, see Associating a Resource with the Vault.
      • If backup is enabled in a vulnerability fix task, vulnerabilities can be fixed only on the servers that can be backed up in this task. For servers that fail to be backed up, start another vulnerability fix task for them.
      Figure 5 Creating a backup
      

   2. Choose Select Server to Scan. The backup creation dialog box is displayed.
   3. In the Create Backup dialog box, set a backup file name, and click OK.

7. In the Fix dialog box displayed, select I am aware that if I have not backed up my ECSs before fixing vulnerabilities, services may be interrupted and fail to be rolled back during maintenance. and click Auto Fix.
8. Click a vulnerability name.
9. Click the Handling History tab to view the fix status of the target vulnerability in the Status column. Table 1 describes vulnerability fix statuses.

   Table 1 Vulnerability fix statuses

   Status	Description
   Unhandled	The vulnerability is not fixed.
   Ignored	The vulnerability does not affect your services. You have ignored the vulnerability.
   Verifying	HSS is verifying whether a fixed vulnerability is successfully fixed.
   Fixing	HSS is fixing the vulnerability.
   Fixed	The vulnerability has been successfully fixed.
   Restart required	The vulnerability has been successfully fixed. You need to restart the server as soon as possible.
   Failed	The vulnerability fails to be fixed. The possible cause is that the vulnerability does not exist or has been changed.
   Restart the server and try again	This status is displayed only for vulnerabilities that exist on Windows servers. The vulnerability has not been fixed on the Windows server for a long time. As a result, the latest patch cannot be installed. You need to install an earlier patch, restart the server, and then install the latest patch.

You can only fix Linux and Windows vulnerabilities with one-click on the console.

1. Log in to the management console.
2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > HSS.
3. In the navigation pane, choose Risk Management > Vulnerabilities.
4. Fix Linux and Windows vulnerabilities.
   • Fixing all Linux or Windows vulnerabilities on a server
     1. Locate the row containing a target server and click Fix in the Operation column.

        You can also select multiple servers and click Fix in the upper part of the vulnerability list. To fix all server vulnerabilities, you just need to click Fix with no need of selecting servers.

        Figure 6 Fixing all the Linux or Windows vulnerabilities on a server
        
     2. In the displayed dialog box, confirm the number of vulnerabilities to be fixed and the number of affected assets.

        For Linux vulnerabilities, you can view fix commands in the dialog box to view the name of the component to be fixed.

     3. (Optional) Back up servers.
        Before fixing vulnerabilities, use HSS to back up servers, so that you can restore their data if it is affected by the fix. If you do not need to back up data, skip this step.

        1. In the Fix dialog box, click to enable backup.
           

           • After backup is enabled, the number of servers that can be backed up will be displayed below the toggle switch. Only the servers associated with backup vaults can be backed up. For more information, see Associating a Resource with the Vault.
           • If backup is enabled in a vulnerability fix task, vulnerabilities can be fixed only on the servers that can be backed up in this task. For servers that fail to be backed up, start another vulnerability fix task for them.
           Figure 7 Creating a configuration backup
           
        2. Choose Select Server to Scan. The backup creation dialog box is displayed.
        3. In the Create Backup dialog box, set a backup file name, and click OK.
     4. In the Fix dialog box displayed, select the type of the vulnerability to be fixed, select I am aware that if I have not backed up my ECSs before fixing vulnerabilities, services may be interrupted and fail to be rolled back during maintenance., and click OK.

        Only Linux and Windows vulnerabilities can be automatically fixed with one-click. Web-CMS and application vulnerabilities need to be manually fixed by logging in to the server.

     5. Click the server name. On the server details slide-out panel displayed, view the vulnerability fix status. Table 2 describes vulnerability fix statuses.
   • Fixing one or more vulnerabilities on a server
     1. Click the name of a target server. The server details slide-out panel is displayed.
     2. Locate the row containing a target vulnerability and click Fix in the Operation column.

        Alternatively, you can select all target vulnerabilities and click Fix above the vulnerability list to fix vulnerabilities in batches. To fix all vulnerabilities, click Fix with no need of selecting any servers.

        Figure 8 Fixing a vulnerability on a server
        
     3. In the displayed dialog box, confirm the number of vulnerabilities to be fixed and the number of affected assets.

        For Linux vulnerabilities, you can view fix commands in the dialog box to view the name of the component to be fixed.

     4. (Optional) Back up servers.

        Before fixing vulnerabilities, you can use HSS to back up servers, so that you can restore their data if it is affected by the fix. If you do not need to back up data, skip this step.

        1. In the Fix dialog box, click to enable backup.
           

           • After backup is enabled, the number of servers that can be backed up will be displayed below the toggle switch. Only the servers associated with backup vaults can be backed up. For more information, see Associating a Resource with the Vault.
           • If backup is enabled in a vulnerability fix task, vulnerabilities can be fixed only on the servers that can be backed up in this task. For servers that fail to be backed up, start another vulnerability fix task for them.
           Figure 9 Creating a backup
           

        2. Choose Select Server to Scan. The backup creation dialog box is displayed.
        3. In the Create Backup dialog box, set a backup file name, and click OK.
     5. In the Fix dialog box displayed, select I am aware that if I have not backed up my ECSs before fixing vulnerabilities, services may be interrupted and fail to be rolled back during maintenance., and click Auto Fix.
     6. In the Status column of the target vulnerability, view the fix status of the vulnerability. Table 2 describes vulnerability fix statuses.

   Table 2 Vulnerability fix statuses

   Status	Description
   Unhandled	The vulnerability is not fixed.
   Ignored	The vulnerability does not affect your services. You have ignored the vulnerability.
   Verifying	HSS is verifying whether a fixed vulnerability is successfully fixed.
   Fixing	HSS is fixing the vulnerability.
   Fixed	The vulnerability has been successfully fixed.
   Restart required	The vulnerability has been successfully fixed. You need to restart the server as soon as possible.
   Failed	The vulnerability fails to be fixed. The possible cause is that the vulnerability does not exist or has been changed.
   Restart the server and try again	This status is displayed only for vulnerabilities that exist on Windows servers. The vulnerability has not been fixed on the Windows server for a long time. As a result, the latest patch cannot be installed. You need to install an earlier patch, restart the server, and then install the latest patch.

HSS cannot automatically fix Web-CMS vulnerabilities, application vulnerabilities, and emergency vulnerabilities in one click. You can log in to the server to manually fix them by referring to the fix suggestions on the vulnerability details slide-out panel.

• Restart the system after you fixed a Windows OS or Linux kernel vulnerability, or HSS will probably continue to warn you of this vulnerability.
• Fix the vulnerabilities in sequence based on the suggestions.
• If multiple software packages on the same server have the same vulnerability, you only need to fix the vulnerability once.

Viewing vulnerability fix suggestions

1. Log in to the management console.
2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > HSS.
3. In the navigation pane, choose Risk Management > Vulnerabilities.
4. Click the name of a target vulnerability to access the vulnerability details slide-out panel and view the fix suggestions.

Fixing vulnerabilities by referring to vulnerability fix suggestions

Vulnerability fix may affect service stability. You are advised to use either of the following methods to avoid such impact:

• Method 1: Create a new VM to fix the vulnerability.
  1. Create an image for the ECS to be fixed. For details, see Creating a Full-ECS Image Using an ECS.
  2. Use the image to create an ECS. For details, see Creating ECSs Using an Image.
  3. Fix the vulnerability on the new ECS and verify the result.
  4. Switch services over to the new ECS and verify they are stably running.
  5. Release the original ECS. If a fault occurs after the service switchover and cannot be rectified, you can switch services back to the original ECS.
• Method 2: Fix the vulnerability on the target server.
  1. Create a backup for the ECS whose vulnerabilities need to be fixed. For details, see Creating a CSBS Backup.
  2. Fix vulnerabilities on the current server.
  3. If services become unavailable after the vulnerability is fixed and cannot be recovered in a timely manner, use the backup to restore the server. For details, see Using Backups to Restore Servers.
  

  • Use method 1 if you are fixing a vulnerability for the first time and cannot estimate impact on services. You are advised to choose the pay-per-use billing mode for the newly created ECS. After the service switchover, you can change the billing mode to yearly/monthly. In this way, you can release the ECS at any time to save costs if the vulnerability fails to be fixed.
  • Use method 2 if you have fixed the vulnerability on similar servers before.
  • After the vulnerability is manually fixed, you are advised to Verify the Vulnerability Fix.

Some vulnerabilities are risky only in specific conditions. For example, if a vulnerability can be exploited only through an open port, but the target server does not open any ports, the vulnerability will not harm the server. Such vulnerabilities can be ignored. HSS will not generate alarms for ignored vulnerabilities.

1. Log in to the management console.
2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > HSS.
3. In the navigation pane, choose Risk Management > Vulnerabilities.
4. Locate the row containing a target vulnerability and click Ignore in the Operation column.
5. In the dialog box displayed, click OK.

If you evaluate that some vulnerabilities do not affect your services and do not want to view the vulnerabilities in the vulnerability list, you can whitelist the vulnerabilities. After they are whitelisted, the vulnerabilities will be ignored in the vulnerability list and no alarms will be reported. The vulnerabilities will not be scanned and the vulnerability information will not be displayed when the next vulnerability scan task is executed.

1. Log in to the management console.
2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > HSS.
3. In the navigation pane, choose Risk Management > Vulnerabilities.
   • Whitelisting all servers that are affected by a vulnerability

     HSS will ignore the vulnerability when scanning for vulnerabilities on all servers.

     1. In the Operation column of the row containing the target vulnerability, click More and select Add to Whitelist.

        You can also select multiple vulnerabilities and click Add to Whitelist above the vulnerability list.

        Figure 10 Whitelisting all servers that are affected by a vulnerability
        
     2. In the dialog box displayed, click OK.
   • Whitelisting one or more servers that are affected by a vulnerability

     HSS will ignore the vulnerability when scanning for vulnerabilities on these servers.

     1. Click a target vulnerability name.
     2. On the slide-out panel displayed, click the Affected tab.
     3. In the Operation column of the row containing the target server, click More and select Add to Whitelist.

        You can also select multiple servers and click Add to Whitelist above the server list.

        Figure 11 Whitelisting a single server that is affected by a vulnerability
        
     4. In the dialog box displayed, click OK.
   • Whitelisting vulnerabilities using whitelist rules
     1. In the upper right corner of the Vulnerabilities page, click Vulnerability Whitelist.
     2. In the Vulnerability Whitelist area, click Add Rule.
     3. Configure a whitelist rule according to Table 3.
        Figure 12 Configuring a whitelist rule
        

        Table 3 Vulnerability whitelist rule parameters

        Parameter	Description
        Type	Select the type of vulnerabilities to be whitelisted. Possible values are as follows: Linux Vulnerabilities Windows Vulnerabilities Web-CMS Vulnerabilities Application Vulnerabilities Emergency Vulnerabilities
        Vulnerability	Select one or more vulnerabilities to be whitelisted.
        Rule Scope	Select the servers affected by the vulnerabilities. Possible values are as follows: All servers HSS will ignore the vulnerability when scanning for vulnerabilities on all servers. Selected servers Select one or more target servers. HSS will ignore the vulnerabilities when scanning for vulnerabilities on these servers. You can search for a target server by server name, ID, EIP, or private IP address.
        Remarks (Optional)	Enter the remarks.

     4. Click OK.