Security Center:View and handle vulnerabilities

Prerequisites

A vulnerability scan is complete. For more information about how to scan for vulnerabilities, see Scan for vulnerabilities.

View vulnerability scan results

View all vulnerabilities

1. Log on to the Security Center console.In the left-side navigation pane, choose Risk Management > Vulnerabilities.
2. On the Vulnerabilities page, view the results of the vulnerability scan.
   • View the overview of the vulnerability scan results.
     In the upper part of the Vulnerabilities page, view the statistical information about vulnerabilities.

     Parameter	Description
     Recommended Fix (CVE)	Click the number below Recommended Fix (CVE) to go to the Recommended Fix (CVE) panel. In the panel, you can view all types of vulnerabilities with the high priority. For more information about how to fix vulnerabilities, see Handle vulnerabilities.
     Vul Servers	Click the number below Vul Servers to go to the Server tab of the Host page. On the Server tab, you can view the details about the servers on which vulnerabilities are detected.
     Fixing	Click the number below Fixing to go to the Fixing panel. In the panel, you can view the list of vulnerabilities that are being fixed and the fix progress.
     Handled Vulnerabilities Today	Click the number below Handled Vulnerabilities Today to go to the Handled Vulnerabilities Today panel. In the panel, you can view information about the assets affected by the vulnerabilities that are fixed on the current day. You can perform the following operations in the panel: View related processes: Click the icon in the Related process column to view the processes or service systems that may be affected when Security Center fixes the vulnerability. View the details about the Alibaba Cloud vulnerability library: Click a Common Vulnerabilities and Exposures (CVE) ID in the CVE ID column to view details about the vulnerability in the Alibaba Cloud vulnerability library. If multiple vulnerabilities are detected on an asset, the number of vulnerabilities is displayed in the CVE ID column. If you want to view the details about a vulnerability, move the pointer over the CVE ID that is displayed and click the CVE ID. View the details about a vulnerability fix: Click Details in the Actions column to view the descriptions and risks of the vulnerability fix. Undo a vulnerability fix: If you have created a snapshot for an asset, you can undo the fixes of vulnerabilities on the asset. To undo a fix, click Rollback in the Actions column. In the dialog box that appears, select the snapshot that you have created and click OK. Note The snapshot of an asset allows you to undo the fixes of the Linux software vulnerabilities and Windows system vulnerabilities that are detected on the asset.
     Total Handled Vulnerabilities	Click the number below Total Handled Vulnerabilities to go to the Total Handled Vulnerabilities panel. In the panel, you can view information about the assets affected by vulnerabilities that are fixed.
     Disclosed Vulnerabilities	Click the number below Disclosed Vulnerabilities to go to the Detectable Vulnerabilities panel. In the panel, you can view the list of and details about the vulnerabilities that can be detected by Security Center. The details include CVE IDs, vulnerability names, vulnerability detection methods, vulnerability disclosure time, and vulnerability types. In the panel, you can also enter a CVE ID or a vulnerability name above the vulnerability list to search for a vulnerability. This way, you can check whether the vulnerability can be detected by Security Center. You can click the CVE ID of a vulnerability to view details about the vulnerability in the Alibaba Cloud vulnerability library.

   • View vulnerabilities.
     Click the tab of a vulnerability type to view the vulnerabilities of the type detected by Security Center in your assets.

     Note If the icon is displayed on the right side of a vulnerability name, the priority of the vulnerability has been changed in the last 15 days or the vulnerability is recently disclosed.
   • View the priorities of vulnerabilities and the number of affected assets.
     The priorities of vulnerabilities are displayed in different colors in the Affected Assets column. The number in each row of the column indicates the total number of the assets affected by a vulnerability. The following list describes the relationship between colors and priorities:

     • Red: High
     • Orange: Medium
     • Gray: Low
     Note We recommend that you fix the vulnerabilities that have the High priority at the earliest opportunity.
   • Search for a vulnerability.

     Use the filters and search box above the list of vulnerabilities to search for a vulnerability. The search conditions include vulnerability priorities, vulnerability statuses, vulnerability names, and CVE IDs.

   • View vulnerability details.

     Click a vulnerability to go to the vulnerability details panel. In the panel, you can view the details about the vulnerability and unhandled vulnerabilities.

     For more information about the parameters in the details panel of a Linux software vulnerability, see Description of the panel that shows the details about a Linux software vulnerability.

   • Click a vulnerability to go to the vulnerability details panel. In the list of unhandled or handled vulnerabilities of the panel, view the fixing status of a vulnerability in the Status column.

     Category	Status	Description
     Handled	Handled	The vulnerability is fixed.
     	Fix Failed	Security Center failed to fix the vulnerability. The file that contains the vulnerability may have been modified or does not exist.
     	Ignored	The vulnerability is ignored. Security Center no longer generates alerts for this vulnerability.
     	Invalid Vulnerability	The vulnerability has not been detected in the last seven days.
     Unhandled	Unfixed	The vulnerability is not fixed.
     	Verifying	After you manually fix a vulnerability, you can click Verify in the Actions column to check whether the vulnerability is fixed. After you click Verify, the status of the vulnerability changes to Verifying from Unfixed.

   • Export the list of vulnerabilities.

     Click the icon in the upper-right corner of the vulnerability list to export the list of vulnerabilities.

View real risk vulnerabilities

The real risk vulnerability model of Security Center evaluates vulnerabilities based on the following factors: Alibaba Cloud vulnerability scoring system, time score, environment score, asset importance score, PoC, exploitability, and severity. This way, the real risk vulnerabilities are automatically identified. You can turn on Show only real risk vulnerabilities to help you fix the exploitable vulnerabilities at the earliest opportunity and improve the fixing efficacy. If you turn off Show only real risk vulnerabilities, all vulnerabilities are displayed. You can perform the following operations to turn on Show only real risk vulnerabilities:

1. Log on to the Security Center console.In the left-side navigation pane, choose Risk Management > Vulnerabilities.
2. On the Vulnerabilities page, turn on Show only real risk vulnerabilities.
   After you turn on the switch, Security Center automatically displays real risk vulnerabilities.

Handle vulnerabilities

Security Center can fix different type of vulnerabilities. For more information about the vulnerability fixing feature in different editions of Security Center, see Types of vulnerabilities that can be detected and fixed.

1. Log on to the Security Center console.In the left-side navigation pane, choose Risk Management > Vulnerabilities.
2. On the Vulnerabilities page, handle vulnerabilities.

   Vulnerability type	Supported operation
   Linux software vulnerability	Security Center allows you to fix and ignore Linux software vulnerabilities. In this example, a Linux software vulnerability is used. The following list describes how to fix and ignore a Linux software vulnerability: Fix If you confirm that the vulnerability needs to be fixed, you can use the quick fixing feature in the Security Center console or log on to the required server to fix the vulnerability. Quick fixing (recommended) Security Center allows you to use the quick fixing feature to fix one or more Linux software vulnerabilities, Windows system vulnerabilities, and Web-CMS vulnerabilities at a time on a server. In the vulnerability list of the Linux Software tab, find the vulnerability and click the vulnerability name in the Vulnerability column. In the vulnerability list of the Pending vulnerability tab in the vulnerability details panel, find the required server and click Fix in the Actions column. In the Repair dialog box, select an option to determine whether to create a snapshot of the server and click Fix Now. You can select multiple servers and click Fix below the vulnerability list to fix the vulnerability on the selected servers. Warning Security Center may fail to fix a vulnerability. If a vulnerability fails to be fixed, service interruptions occur. Before you fix a vulnerability, we recommend that you create a snapshot of the system. This allows you to restore service data by using the snapshot in an efficient manner. Manual fixing In the vulnerability list of the Linux Software tab, find the vulnerability and click the CVE ID of the vulnerability in the CVE ID column to go to the Alibaba Cloud vulnerability library. In the SOLUTION section, view the solution to the vulnerability. Then, log on to the required server to fix the vulnerability based on the solution. After the vulnerability is fixed, find the vulnerability in the vulnerability list of the Security Center console and click the vulnerability name in the Vulnerability column to go to the vulnerability details panel. In the vulnerability list of the Pending vulnerability tab, find the server on which you fixed the vulnerability and click Verify in the Actions column to check whether the vulnerability is successfully fixed. If the vulnerability is successfully fixed, the status of the vulnerability changes to Handled. Ignore If you confirm that the vulnerability does not need to be fixed, you can add the vulnerability to the whitelist to ignore the vulnerability. After the vulnerability is added to the whitelist, Security Center no longer generates alerts for the vulnerability on the specified servers in the subsequent detection. In this example, a Linux software vulnerability is used. You can perform the following operations to ignore a Linux software vulnerability: In the vulnerability list of the Linux Software tab, find the vulnerability and click the vulnerability name in the Vulnerability column. In the vulnerability list of the Pending vulnerability tab in the vulnerability details panel, select one or more servers for which you want to ignore the vulnerability and click Ignore below the vulnerability list. In the dialog box that appears, enter a description and click OK.
   Windows system vulnerability
   Web-CMS vulnerability
   Application vulnerability	Application vulnerabilities and urgent vulnerabilities do not support quick fixing. If you want to fix these types of vulnerabilities, you must log on to the server on which the vulnerabilities are detected and manually fix the vulnerabilities based on the fix suggestions that are provided on the details pages of the vulnerabilities. In this example, an application vulnerability is used. The following list describes how to fix and ignore an application vulnerability: Fix If you confirm that the vulnerability needs to be fixed, you can log on to the required server to manually fix the vulnerability. In the vulnerability list of the Application tab, find the vulnerability and click the vulnerability name in the Vulnerability column. In the vulnerability list of the Pending vulnerability tab in the vulnerability details panel, find the affected asset and click Details in the Actions column. In the panel that appears, view the solution to the vulnerability in the Security suggestions section. Then, log on to the required server to fix the vulnerability based on the solution. After the vulnerability is fixed, find the vulnerability in the vulnerability list of the Security Center console and click the vulnerability name in the Vulnerability column to go to the vulnerability details panel. In the vulnerability list of the Pending vulnerability tab, find the server on which you fixed the vulnerability and click Verify in the Actions column to check whether the vulnerability is successfully fixed. If the vulnerability is successfully fixed, the status of the vulnerability changes to Handled. Ignore If you confirm that the vulnerability does not need to be fixed, you can add the vulnerability to the whitelist to ignore the vulnerability. After the vulnerability is added to the whitelist, Security Center no longer detects the vulnerability on the specified servers in the subsequent detection. In this example, an application vulnerability is used. You can perform the following operations to ignore an application vulnerability: In the vulnerability list of the Application tab, find the vulnerability and click the vulnerability name in the Vulnerability column. In the vulnerability list of the Pending vulnerability tab in the vulnerability details panel, select one or more servers for which you want to ignore the vulnerability and click Ignore below the vulnerability list. In the dialog box that appears, enter a description and click OK.
   Urgent vulnerability

FAQ

1. I want to fix a vulnerability, but the Fix button is dimmed. Why?

• The Fix button for a Linux software vulnerability is dimmed
  • For some outdated or commercial operating systems, you must manually upgrade the operating systems to fix vulnerabilities.
    Note If you use one of the following operating systems, you must upgrade your operating system to fix vulnerabilities:

    • Red Hat 5, Red Hat 6, Red Hat 7, and Red Hat 8
    • CentOS 5
    • Ubuntu 12
  • Linux software vulnerabilities may fail to be fixed due to issues, such as insufficient disk space on your server or unauthorized access to files. Before you fix Linux software vulnerabilities in the Security Center console, you must manually handle the issues on the server. The following list describes these issues and solutions:
    • The disk space is less than 3 GB.

      Solution: Resize or clear the disk. Then, fix the vulnerabilities again in the Security Center console.

    • The apt-get or APT/YUM process is running.

      Solution: Wait until the process is complete, or manually stop the process. Then, fix the vulnerability again in the Security Center console.

    • The system prompts insufficient permissions on running the APT, YUM, or RPM command.
      Solution: Check and manage access permissions on the files. We recommend that you set file permissions to 755, and make sure that the file owner is the root user. Then, fix the vulnerability again in the Security Center console.

      Note After you set file permissions to 755, the file owner has the read, write, and execute permissions on the file. Other users and the user group to which the file owner belongs have read and execute permissions on the file.
• The Fix button for a Windows system vulnerability is dimmed
  If the disk space of a server is insufficient or the Windows Update service is running, Windows system vulnerabilities fail to be fixed and the Fix button is dimmed. To fix the vulnerabilities, you must handle the issues on the server. To view the server issues and solutions provided by Security Center, move the pointer over the Fix button. You must manually handle the following issues:

  • The Windows Update service is running.

    Solution: Wait for a few minutes and fix the vulnerabilities again. Alternatively, terminate the Wusa process on the server and fix the vulnerabilities again in the Security Center console.

  • The Windows Update service is disabled.

    Solution: Start Task Manager of the server and enable the Windows Update service. Then, fix the vulnerabilities again in the Security Center console.

  • The server disk space is less than 500 MB.

    Solution: Resize or clear the disk. Then, fix the vulnerabilities again in the Security Center console.

2. Linux software vulnerabilities and Windows system vulnerabilities fail to be fixed. Why?

If the system prompts that a fix failed when you fix a Linux software vulnerability or a Windows system vulnerability in the Security Center console, follow the instructions in the following table to troubleshoot the failure.

3. Web-CMS vulnerabilities fail to be fixed. Why?

If the system prompts that a fix failed when you fix a Web-CMS vulnerability in the Security Center console, follow the instructions in the following table to troubleshoot the failure.

4. After a fix a vulnerability, the status of the vulnerability is still Unfixed. Why?

After you fix a vulnerability, the status of the vulnerability is not automatically updated. The status is updated only after you perform a vulnerability scan. The following list describes possible causes and solutions. The causes and solutions vary based on the Security Center edition.

• Basic and Anti-virus: The vulnerability is still in the Unfixed state because latency exists in vulnerability scans. Security Center automatically scans for vulnerabilities every two days. We recommend that you check the status of the vulnerability two days after you fix the vulnerability.
• Advanced, Enterprise, and Ultimate: After you fix the vulnerability, you must manually perform a vulnerability scan. After the vulnerability scan is complete, you can view the latest status of the vulnerability. For more information, see Scan for vulnerabilities.

5. Does Security Center automatically fix vulnerabilities?

No, Security Center does not automatically fix vulnerabilities. Security Center supports only the vulnerability detection and quick fixing features. After you enable the quick fixing feature, Security Center delivers vulnerability fixing tasks online. When Security Center scans for vulnerabilities, Security Center also verifies whether the vulnerabilities are fixed. If a previously detected vulnerability is not detected in the vulnerability scan, Security Center changes the status of the vulnerability to Fixed. A previously detected vulnerability may not be detected in the vulnerability scan due to the following reasons: You logged on to the server on which the vulnerability is detected and manually updated the software package. The container on which the vulnerability is detected stops running. The components of the vulnerability do not exist. The process on which the vulnerability is detected does not exist.

References

How often does Security Center detect vulnerabilities?

What are the differences between baselines and vulnerabilities?

What do I do if I cannot enable the vulnerability detection feature for a server on the Assets page?

The "0x80240017 104 (Patch Not Applicable)" error is returned when you fix Windows system vulnerabilities. How do I handle the issue?