Security Center:FAQ about risk management

How do I manually detect Linux software vulnerabilities on my servers?

You can use command lines to manually detect Linux software vulnerabilities on your servers. For more information, see How do I manually detect Linux software vulnerabilities?

We recommend that you use the feature provided by Security Center to detect Linux software vulnerabilities. This feature automatically detects vulnerabilities in a timely manner on a regular basis.

How do I view the current software version and vulnerability details?

How do I update kernel 3.1* to kernel 4.4 on Ubuntu 14.04?

How do I check whether a vulnerability is fixed by using Ubuntu kernel patches?

If you modified the boot sequence in the GRUB boot menu and installed a new kernel on your Ubuntu server, the new kernel is not enabled when you restart the Ubuntu server. You must configure environment variables to enable the new kernel.

When you fix Ubuntu kernel vulnerabilities in the Log on to the Security Center console, you must restart the system to allow the fix to take effect. If you modified the GRUB boot menu, the system does not automatically create a boot menu for the new kernel when the system is restarted. The system remains in the Handled (To Be Restarted) state after being restarted. In this case, you cannot check whether the vulnerability is fixed.

If you want to use the default settings of the new kernel rather than the original GRUB boot menu configurations, specify the following environment variable on the Linux server before you run the command to fix vulnerabilities. This way, the system uses the default settings of the new kernel.

export DEBIAN_FRONTEND=noninteractive

If you do not use the default settings of the latest kernel, you can modify the GRUB boot sequence. For more information, see How do I modify the boot sequence of the Linux kernel?

Do I need to restart my server after I fix a vulnerability?

• Windows servers:

  After you fix a Windows system vulnerability in the Security Center console, you must restart your server to validate the fix.

  This applies to all servers that run Windows.

• Linux servers:
  After you fix a Linux kernel vulnerability in the Security Center console, you must restart your server to validate the fix. This applies if one of the following conditions are met:

  • Your server runs Linux, and the vulnerability that you fix is a Linux kernel vulnerability.
  • On the Linux Software tab, the vulnerability that you fix is tagged with Restart required. You can perform the following steps to go to the Linux Software tab: Log on to the Security Center console. In the left-side navigation pane, choose Risk Management > Vulnerabilities.

What do I do if Security Center continues to send a vulnerability alert to me after I update the kernel?

This issue may occur if the remaining files of the old kernel version exist. If you confirm that the alert is triggered due to the remaining files of the old kernel version, you can ignore this alert or delete the remaining files. To fix this issue, you can perform the following steps:

1. After the kernel is updated, run the uname -av and cat /proc/version commands to view the current kernel version. Make sure that the current kernel version meets the requirement that is described in the vulnerability details.
2. Run the cat /etc/grub.conf command to query the configuration file. Make sure that the current system uses the latest kernel version.
3. Security Center determines whether your server contains Linux software vulnerabilities based on the kernel version. If your system contains the Package Manager (RPM) package of the old kernel version, the package is detected by Security Center, which then generates an alert. Make sure that your system does not contain the RPM package of the old kernel version. If your system contains the RPM package of the old kernel version, delete the package.
   Note Before you delete the RPM package of the old kernel version, make sure that the current system uses the latest kernel version. We recommend that you create a snapshot of your system before you delete the RPM package of the old kernel version. If exceptions occur, you can use the snapshot to restore your system.

What do I do If no update is released for the software package that has a vulnerability?

Perform the following operations based on your business requirements:

• You may receive one of the following messages when you update software to fix a vulnerability:

  Package xxx already installed and latest version
  Nothing to do

  Or

  No Packages marked for Update

  In this case, wait until an official update of the software package is available.

  The following software packages do not have available updates:

  • Gnutls
  • Libnl
  • MariaDB
• After you update the software package to the latest version, the software package may still fail to meet the version requirement that is described in the Security Center console.

  In this case, check whether the operating system version of your server is supported. For example, since September 1, 2017, CentOS 6.2 to 6.6 and CentOS 7.1 are no longer supported. If your operating system version is not supported, we recommend that you ignore the vulnerability in the Security Center console or update the operating system of your server. If you ignore the vulnerability, the risk may still exist.

How do I view the parameters of Linux software vulnerabilities?

How do I fix vulnerabilities?

Security Center can detect Linux software vulnerabilities, Windows system vulnerabilities, Web-CMS vulnerabilities, application vulnerabilities, and urgent vulnerabilities. However, Security Center can fix only Linux software vulnerabilities, Windows system vulnerabilities, and Web-CMS vulnerabilities.

Log on to the Security Center console, choose Risk Management > Vulnerabilities in the left-side navigation pane. On the Vulnerabilities page, find the Linux software vulnerability, Windows system vulnerability, or Web-CMS vulnerability that you want to fix and click Fix in the Actions column. You can create a snapshot before you fix a Linux software vulnerability or Windows system vulnerability. After you fix a vulnerability, the status of the vulnerability that requires a system restart changes to Handled (To Be Restarted). You must restart your server as instructed before you check whether the vulnerability is fixed.

For urgent vulnerabilities and application vulnerabilities, you can manually fix the vulnerabilities based on the fix suggestions that are provided in the vulnerability details panel. After you fix a vulnerability, you can check whether the vulnerability is fixed on the Vulnerabilities page.

I want to fix multiple vulnerabilities at a time in the Security Center console. What is the fixing order?

Linux software vulnerabilities and Web-CMS vulnerabilities are fixed based on the order of vulnerabilities on the vulnerability list in the Security Center console. For specific Windows system vulnerabilities, pre-patches are required before Security Center can fix the vulnerabilities. When multiple Windows system vulnerabilities are fixed, vulnerabilities that require pre-patches are fixed before other vulnerabilities. Other vulnerabilities are fixed based on the order of vulnerabilities on the vulnerability list in the Security Center console.

I fail to create a snapshot when I fix a vulnerability. Why? What do I do?

Why does Security Center continue to send alerts to me after I fix vulnerabilities? What do I do?

This issue occurs because your server is not restarted and the restart is required after you fix vulnerabilities. The vulnerabilities refer to Linux kernel vulnerabilities in this situation. To restart your server, go to the panel that displays vulnerability details and click Restart in the Actions column. After your server is restarted, you can click Verify in the Actions column. If the status of the vulnerability changes to Handled, the vulnerability is fixed.

What do I do if the "An error occurred while obtaining the permission. Check the permission and try again." message appears when I fix a vulnerability?

This issue occurs because your account does not have permissions to manage the file required to fix the vulnerability. We recommend that you find the vulnerability that you want to fix in the Security Center console and click the vulnerability name. In the panel that appears, view the details of the vulnerability and check whether the owner of the file is the root user. If the owner is not the root user, you must change the owner to the root user. Then, you can go back to the Security Center console to fix the vulnerability.

Why are the records of the detected vulnerabilities still displayed in the Security Center console after the Security Center agent is disabled or disconnected from Alibaba Cloud?

The records of detected vulnerabilities are displayed in the Security Center console after the Security Center agent is disabled or disconnected from Alibaba Cloud.

If the Security Center agent is disabled or disconnected from Alibaba Cloud, the alerts generated for all detected system vulnerabilities become invalid after 3 days, the alerts generated for all detected application vulnerabilities become invalid after 30 days, and the alerts generated for all detected urgent vulnerabilities become invalid after 90 days. In this case, you cannot perform operations on the vulnerabilities. For example, you cannot fix the vulnerabilities or delete the records of the vulnerabilities.

If you do not renew Security Center within seven days after Security Center expires, your data is released and deleted, and the detected vulnerabilities are no longer displayed.

How do I delete a patch that is required to fix a Windows system vulnerability from the directory of the Security Center agent?

Can Security Center detect Elasticsearch vulnerabilities?

Yes, Security Center can detect Elasticsearch vulnerabilities.

You can perform the following steps: Log on to the Security Center console. In the left-side navigation pane, choose Risk Management > Vulnerabilities and click the Application tab. Then, check whether Elasticsearch vulnerabilities are detected.

How do I handle a connection timeout between my server and the YUM repository of Alibaba Cloud?

[Errno 12] Timeout on http://mirrors.aliyun.com/centos/6/os/x86_64/repodata/repomd.xml: (28, 'connect() timed out!')

Make sure that the DNS settings of your server are correct, and wait a while. If the issue persists, submit a ticket to contact technical support.

The "Invalid token" error message appears when I fix a vulnerability. What do I do?

What do I do if Security Center fails to verify the fix of a system vulnerability?

If the issue persists, we recommend that you update the operating system.

Can Security Center automatically verify the fix of a vulnerability that requires a system restart?

No, Security Center cannot automatically verify the fix of a vulnerability that requires a system restart.

If a vulnerability is fixed and a system restart is required to verify the fix, the state of the vulnerability is Handled (To Be Restarted). Security Center scans for vulnerabilities on a daily basis. After you fix vulnerabilities of this type, Security Center no longer detects these vulnerabilities. In this case, Security Center retains the information about these vulnerabilities for three days. Make sure that networks can work as expected and no other factors can affect vulnerability detection. After three days, the vulnerability information is deleted.

Why does the state of a vulnerability remain unchanged when I verify the vulnerability fix?

After you run the command generated by Security Center to fix a Linux software vulnerability, the Linux software is updated. The new software version meets the requirement described on the Vulnerabilities page of the Security Center console. However, when you click Verify in the panel that displays the details of the vulnerability, the state of the vulnerability does not change to Fixed.

Why does Security Center fail to roll back a fix for a vulnerability?

What do I do if I cannot enable the vulnerability detection feature for a server on the Assets page?

In the upper-right corner of the Vulnerabilities page, click Settings. In the Settings panel, you can select the servers for which you want to enable the vulnerability detection feature. In the following figure, Scan-Disabled: 4 indicates that Security Center cannot detect Linux software vulnerabilities for four servers. To enable Security Center to detect Linux software vulnerabilities for the servers, click Manage.

Are my workloads affected when Security Center scans for urgent vulnerabilities?

Security Center checks whether your assets contain urgent vulnerabilities based on the preliminary detection principle. Security Center sends one or two TCP request packets to the IP addresses of all your Elastic Compute Service (ECS) or Server Load Balancer (SLB) instances. The packets do not contain malicious behavior. The feature of urgent vulnerability detection was tested on millions of IP addresses and showed highly stable and reliable performance. However, test environments cannot cover all scenarios. Therefore, unknown risks may still occur. For example, if the business logic of some websites is vulnerable, one or two TCP request packets may cause the server to fail. In this case, your business system may be at risk.

Why are the results different when Security Center scans multiple times for fastjson urgent vulnerabilities?

Whether fastjson vulnerabilities can be detected is based on whether JAR packages are loaded. A web server loads JAR packages in dynamic mode or static mode. In dynamic mode, fastjson vulnerabilities can be detected only if JAR packets are running. Therefore, the scan results are different. We recommend that you scan for fastjson vulnerabilities multiple times to improve the accuracy of scan results.

How often does Security Center detect vulnerabilities?

If you want to enable or disable scans for vulnerabilities of a specific type, or modify the scan cycles for application vulnerabilities and urgent vulnerabilities, click Settings in the upper-right corner of the Vulnerabilities page. For more information, see Scan for vulnerabilities. If you want to immediately scan for vulnerabilities on your assets, you can use the quick scan feature that is provided by Security Center. For more information, see Scan for vulnerabilities.

After the vulnerability detection is complete, choose Risk Management > Vulnerabilities in the left-side navigation pane of the Security Center console to view the detection results and handle vulnerabilities if vulnerabilities are detected.

Can Security Center detect system- and application-layer vulnerabilities?

Yes, Security Center can detect system- and application-layer vulnerabilities.

What do I do if Security Center fails to verify a fixed baseline check risk?

What are the differences between baselines and vulnerabilities?

Baselines describe the minimum security requirements for system configurations and management. Baselines include service and application configurations, configurations for operating system components, permission settings, and system management rules. The baseline check feature of Security Center provides security checks for your operating systems, databases, software, and containers. This feature supports the following baseline types: weak passwords, account permissions, identity authentication, password policies, access control, security audit, and intrusion prevention. This way, you can improve system security based on the check results and suggestions provided by Security Center. For more information about check items, see Baselines.

Vulnerabilities refer to flaws in operating system implementation or security policies. The flaws include defects that exist in the design of operating system software or applications, and errors that occur during the development of the software or applications. Attackers can exploit vulnerabilities to access and steal the data on your servers or undermine the security of your servers. We recommend that you fix detected vulnerabilities at the earliest opportunity to protect your assets.

Baseline check is a value-added feature of Security Center. Only users of the Advanced, Enterprise, and Ultimate editions can use this feature. Users of the Basic and Anti-virus editions must upgrade Security Center to the Advanced or Enterprise edition to use this feature. For more information about upgrades, see Upgrade and downgrade Security Center.

What do I do if sensitive information is leaked?

When enterprises or individuals use GitHub, Gitee, or other platforms to manage source code, the source code contains or may contain the following sensitive information: AccessKey pairs of Alibaba Cloud accounts, accounts and passwords of ApsaraDB RDS databases, email accounts and passwords, and accounts and passwords of self-managed databases that are hosted on ECS instances. If the preceding account information is leaked, attackers may use the information to access Alibaba Cloud resources and data of enterprises or individual users.

After an enterprise creates a database on an ECS instance, developers may write sensitive information to the configuration file that is used to connect to the database. Sensitive information includes database connection passwords and email passwords. After attackers obtain the leaked passwords from GitHub and pass authentication, the attackers can obtain the data of the enterprise. This causes major security risks for the enterprise.