FAQ

• View the current software version and vulnerability details in the Security Center console

  Log on to the Security Center console and choose Precaution > Vulnerabilities. On the page that appears, view the system software version and vulnerability details. For more information about the details of system software vulnerabilities, see How do I view parameters of Linux software vulnerabilities?.

• View details of the current software version on your server
  You can view details of the current software version on your server:

  • CentOS

    Run the rpm -qa | grep xxx command. xxx specifies the name of the software package. For example, you can run the rpm -qa | grep bind-libs command to view the version details of software package bind-libs.

  • Ubuntu and Debian
    Run the dpkg-query -W -f '${Package} -- ${Source}\n' | grep xxx command. xxx specifies the name of the software package. For example, you can run the dpkg-query -W | grep bind-libs command to view the version details of software package bind-libs.

    Note If the specified software package is not found, run the dpkg-query -W command to view all the software installed on your server.
  After you obtain your software version information, you can check whether your software version is mentioned in the descriptions of system software vulnerabilities detected by Security Center. In the descriptions of a vulnerability, Software and Cause specify the version of the current software and the reason why Security Center determines your server has the vulnerability.

  Note After you update software, Security Center may collect the remaining files of the old software version and generate a vulnerability alert on the remaining files. We recommend that you ignore the vulnerability alerts generated in such situations. You can run the yum remove or apt-get remove command to delete the old software package. Before you delete the package, make sure that the old software version is no longer required by services or applications on your server.

1. Run the uname -av command to check whether the kernel version is 3.1*.
2. Run the following commands to check whether the update package of the latest kernel is available:

   apt list | grep linux-image-4.4.0-94-generic
   apt list | grep linux-image-extra-4.4.0-94-generic

3. If no update package is available, you can run the apt-get update command to obtain the latest update package.
4. Run the following commands to update the kernel:

   apt-get update && apt-get install linux-image-4.4.0-94-generic
   apt-get update && apt-get install linux-image-extra-4.4.0-94-generic

5. After the update package is installed, restart the server to load the kernel.
6. After the server is restarted, run the following commands to verify the update:
   • Run the uname -av command to query the current kernel version.
   • Run the dpkg -l | grep linux-image command to query the kernel information.

• The server is Linux-based and the vulnerability that you fix is a Linux kernel vulnerability.
• On the Linux Software tab, the vulnerability that you fix has tag Restart Required. You can perform the following steps to view the vulnerability information: Log on to the Security Center console. In the left-side navigation pane, choose Precaution > Vulnerabilities.

1. Log on to the Security Center console.
2. In the left-side navigation pane, choose Precaution > Vulnerabilities.
3. On the Linux Software tab, find the vulnerability that you want to ignore and click the vulnerability name. The details page of the vulnerability appears.
4. In the Actions column, click the icon and select Ignore.

• Vulnerability
  The name of a Linux software vulnerability notice, which starts with CVE, RHSA, or USN. For example, RHSA-2016: 2972: vim security update.
• Impact

  A vulnerability impact, which is a score based on the open criteria Common Vulnerability Scoring System (CVSS). The CVSS score indicates the severity of a vulnerability, which allows you to prioritize the vulnerability.

• CVE ID

  The Common Vulnerabilities and Exposures ID (CVE ID) of a vulnerability. For example, CVE-2016-XXXX. The CVE system provides a reference-method for public information-security vulnerabilities and exposures. You can find information about vulnerability fixes in a CVE-compatible database to help you solve security issues.

• Priority
  The priority of a vulnerability, including high, medium, and low.

  Note The vulnerability priority in the preceding figure is Medium. You can fix these vulnerabilities later.
  • The following vulnerabilities have the High priority:
    • Vulnerabilities that attackers can exploit to obtain permissions on your server operating system.
    • Vulnerabilities that attackers can exploit to obtain sensitive data and cause data breaches.
    • Vulnerabilities that can cause unauthorized access to sensitive data.
    • Vulnerabilities that can cause large-scale impacts.
  • The following vulnerabilities have the Medium priority:
    • Vulnerabilities that attackers can exploit to indirectly obtain permissions on your server and application systems.
    • Vulnerabilities that attackers can exploit to read, download, write, or delete files.
    • Vulnerabilities that can cause sensitive data breaches.
    • Vulnerabilities that can cause workload disruption or remote denial-of-service attacks.
  • The following vulnerabilities have the Low priority:
    • Vulnerabilities that affect users during system and user interactions.
    • Vulnerabilities that attackers can exploit to perform unauthorized activities.
    • Vulnerabilities that attackers can exploit after they change local configurations or obtain important information.
    • Vulnerabilities that can cause local denial-of-service attacks.
    • Vulnerabilities that have minor impacts.
• Impact description

  Provides information about the current software version, the cause of a vulnerability, and the path of the software where the vulnerability is detected.

  On the details page of a vulnerability, click Details in the Actions column to view the impact description of the vulnerability.
  The impact description includes the following information:

  • Software: the current version of the software. In the preceding figure, the version of mariadb-libs is 5.5.52-1.el7.
  • Cause: explains why the vulnerability is detected. In most cases, the reason is that the current version of the software is outdated. In the preceding figure, the vulnerability is detected because the version of mariadb-libs is earlier than 1:5. 5.56-2.el7.
  • Path: the path of the software where Security Center detects the vulnerability. In the preceding figure, the path of mariadb-libs is /etc/ld.so.conf.d/mariadb-x86_64.con.
• Actions
  You can perform the following operations on a detected Linux vulnerability:

  • Fix: fixes the vulnerability.
  • Verify: verifies whether the vulnerability is fixed.
  • Ignore: ignores the vulnerability.

  For more information, see Linux software vulnerabilities.

1. Log on to the Security Center console.
2. In the left-side navigation pane, click Settings.
3. Optional. Disable self-protection for the client.

   By default, self-protection for the client is disabled. If you retain the default settings, skip this step.

   If you enable self-protection for the client, all process files in the directory of the Security Center agent are protected. In this case, Security Center rejects your requests to delete or download a process file from the directory of the Security Center agent. For more information, see Client protection.

4. Log on to your server as an administrator.
5. Find the patch and manually delete it.

   The path of the patch: C:\Program Files (x86)\Alibaba\Aegis\globalcfg\hotfix

[Errno 12] Timeout on http://mirrors.aliyun.com/centos/6/os/x86_64/repodata/repomd.xml: (28, 'connect() timed out!')

1. Check the software version where Security Center detects the vulnerability.
2. Check whether the system uses the YUM repository of Alibaba Cloud.
3. Check whether you have verified the vulnerability fix after a system update.
   Note You must restart the system after a kernel update.
4. Make sure that the software version that you update to is not earlier than the version recommended by Security Center.

• Check the priority levels of vulnerabilities that Security Center detects

  Perform the following steps:

  1. Log on to the Security Center console.
  2. In the left-side navigation pane, choose Precaution > Vulnerabilities.
  3. On the Vulnerabilities page, click Settings in the upper-right corner.
  4. On the Settings page, view Vul scan level.

  If you do not select a specific priority level, Security Center does not automatically update the information about vulnerabilities of the priority. You can select priority levels for scan based on your needs.

• Check whether the version of the Security Center agent is outdated

  If the version of the Security Center agent on your server is outdated, Security Center may not support vulnerability detection. If the Security Center agent is not automatically updated, we recommend that you manually install the latest version. For more information, see Install the Security Center agent.

• Check whether the Security Center agent is offline

  If the Security Center agent on your server is offline, you cannot verify vulnerability fixes. We recommend that you troubleshoot the issue and make sure that the Security Center agent is online. For more information, see Identify why the agent is offline.

1. Make sure that the Security Center agent on your server is online. If the Security Center agent is offline, troubleshoot the issue. For more information, see Identify why the agent is offline.
2. Check whether the files related to this vulnerability have already been manually modified or deleted.
   Note To avoid accidental modifications on your files, if the related files have been manually modified or deleted after a vulnerability fix, Security Center cannot roll back the fix.

• Check whether the version of the Security Center agent is outdated

  If the version of the Security Center agent on your server is outdated, Security Center may fail to verify a fixed baseline check risk. If the Security Center agent is not automatically updated, we recommend that you manually install the latest version. For more information, see Install the Security Center agent.

• Check whether the Security Center agent is offline

  If the Security Center agent on your server is offline, Security Center cannot verify a fixed baseline check risk. Make sure that the Security Center agent on your server is online. For more information, see Identify why the agent is offline.