Security Center provides the vulnerability fixing feature. You can use Security Center to detect and fix common types of vulnerabilities. This helps you understand the vulnerabilities in your assets in a comprehensive manner and fix the vulnerabilities. This topic describes the types of vulnerabilities that can be detected and fixed, the priorities to fix vulnerabilities, and the supported operating systems.

Types of vulnerabilities that can be detected and fixed

The following table describes the types of vulnerabilities that can be detected and fixed in each edition of Security Center.

Note The following symbols are used in the table:
  • Tick: indicates that the feature is supported.
  • Cross: indicates that the feature is not supported.
Vulnerability type Feature Basic edition Anti-virus edition Advanced edition Enterprise edition Ultimate edition
Linux software vulnerability Manual vulnerability scan Cross Cross Tick Tick Tick
Periodic automatic vulnerability scan Tick(The default scan cycle is two days.) Tick(The default scan cycle is two days.) Tick(The default scan cycle is one day.) Tick(The default scan cycle is one day.) Tick(The default scan cycle is one day.)
Vulnerability fixing Cross Cross Tick Tick Tick
Windows system vulnerability Manual vulnerability scan Cross Cross Tick Tick Tick
Periodic automatic vulnerability scan Tick(The default scan cycle is two days.) Tick(The default scan cycle is two days.) Tick(The default scan cycle is one day.) Tick(The default scan cycle is one day.) Tick(The default scan cycle is one day.)
Vulnerability fixing Cross Cross Tick Tick Tick
Web-CMS vulnerability Manual vulnerability scan Cross Cross Tick Tick Tick
Periodic automatic vulnerability scan Tick(The default scan cycle is two days.) Tick(The default scan cycle is two days.) Tick(The default scan cycle is one day.) Tick(The default scan cycle is one day.) Tick(The default scan cycle is one day.)
Vulnerability fixing Cross Cross Tick Tick Tick
Application vulnerability Manual vulnerability scan Cross Cross Cross Tick Tick
Periodic automatic vulnerability scan Cross Cross Cross Tick(The default scan cycle is one week. You can specify a custom scan cycle.) Tick(The default scan cycle is one week. You can specify a custom scan cycle.)
Vulnerability fixing Cross Cross Cross Cross Cross
Urgent vulnerability Manual vulnerability scan Tick Tick Tick Tick Tick
Periodic automatic vulnerability scan Cross Cross Tick(The default scan cycle is one week. You can specify a custom scan cycle.) Tick(The default scan cycle is one week. You can specify a custom scan cycle.) Tick(The default scan cycle is one week. You can specify a custom scan cycle.)
Vulnerability fixing Cross Cross Cross Cross Cross
Note Security Center can only detect urgent vulnerabilities and application vulnerabilities, but cannot fix these types of vulnerabilities. If you want to fix these types of vulnerabilities, you must log on to the server on which the vulnerabilities are detected and manually fix the vulnerabilities based on the fix suggestions that are provided on the details pages of the vulnerabilities.

Priorities to fix vulnerabilities

If multiple vulnerabilities are detected on your assets, you may be unable to identify the vulnerability that needs to be fixed at the earliest opportunity. To address this issue, Security Center provides the Alibaba Cloud vulnerability scoring system that evaluates vulnerabilities and prioritizes remediation for the vulnerabilities. This way, you can determine the priorities to fix vulnerabilities based on the score of urgency to fix a vulnerability.

Alibaba Cloud vulnerability scoring system

The Common Vulnerability Scoring System (CVSS) can evaluate the scopes and impacts of vulnerabilities. The CVSS can also evaluate the possibility of exploiting a vulnerability and inform you about the consequences of the vulnerability. Alibaba Cloud analyzes the severity levels of vulnerabilities that are detected in actual attack and defense scenarios, and then develops a vulnerability scoring system based on the principles of CVSS.

The Alibaba Cloud vulnerability scoring system determines the score of urgency to fix a vulnerability based on the severity level of the vulnerability in the actual cloud-based attack and defense scenarios, the exploitability of the vulnerability in the threat detection model, and the status of exploits that are disclosed on the Internet. The severity level can be low, medium, high, or critical, and the severity level is converted from the score that the CVSS gives to the vulnerability. The threat detection model is provided by Security Center. This way, the system helps enterprises remediate vulnerabilities that are at high risk of being exploited and ensures the effectiveness of vulnerability remediation.
Note The severity level of a vulnerability is determined based on the following factors:
  • Technology.
  • Exploitability, which can be a proof of concept (PoC), an exploit, a weaponized worm, or a weaponized virus.
  • Threat. This factor indicates whether the vulnerability can be exploited to obtain server permissions.
  • Number of IP addresses that are affected after the vulnerability is exploited. This factor indicates how much possible the vulnerability is exploited by attackers.
Vulnerability score

Formula for the score of urgency to fix a vulnerability

The score of urgency to fix a vulnerability dynamically changes. After a vulnerability is disclosed, the Alibaba Cloud vulnerability scoring system gives a score to the vulnerability based on the impacts that may be caused by the vulnerability. The score is called the Alibaba Cloud vulnerability score. When operating systems are updated, some vulnerabilities are fixed. Therefore, fewer vulnerabilities are detected on these systems, and the threat of existing vulnerabilities on the systems is reduced. This lowers the score of urgency to fix this type of vulnerability. In addition, the score of urgency to fix a vulnerability is affected by the deployment environment and the importance of an asset.

Alibaba Cloud provides the following formula to calculate the score of urgency to fix a vulnerability:

Score of urgency to fix a vulnerability = Alibaba Cloud vulnerability score × Time score × Environment score × Asset importance score

The following table describes the elements in the formula.
Element Description Remarks
Alibaba Cloud vulnerability score The score is generated based on the Alibaba Cloud vulnerability scoring system. The score is used to evaluate the severity level of a vulnerability.
Time score A dynamic time curve is used. The curve is generated based on factors such as the postponement in the deployment of vulnerability mitigation and the popularization of vulnerability exploit methods. Valid values: 0 to 1. Within three days after a vulnerability is exposed, the possibility that the vulnerability is exploited significantly increases. During this period, the time score increases from 0 to a temporary peak value, which is less than 1. After this period, the time score significantly decreases. Vulnerabilities become easier to be exploited over time due to increased exploitability. The time score increases and approaches 1 within 100 days.
Environment score The score indicates the environmental condition of your server. Security Center calculates the environment score based on factors such as the conditions of exploiting a vulnerability and the status of your server. The environment score is an important element in the preceding formula.

The following list describes the factors that determine the environment score:

  • Your server is connected to the Internet:
    • If a vulnerability can be remotely exploited, the environment score is 1.5.
    • If a vulnerability can be exploited, the environment score is 1.2.
    • If a vulnerability can be locally exploited, the environment score is 1.
    • If a vulnerability can be exploited only in a complex cloud environment, Security Center adjusts the environment score based on the actual conditions of your server.
  • Your server is connected to an internal network instead of the Internet:
    • If a vulnerability can be remotely exploited, Security Center adjusts the environment score based on the actual conditions of your server.
    • If a vulnerability can be exploited, the environment score is 1.2.
    • If a vulnerability can be locally exploited, the environment score is 1.
    • If a vulnerability can be exploited only in a complex cloud environment, Security Center adjusts the environment score based on the actual conditions of your server.
Asset importance score If you have a large number of servers, the system calculates asset importance scores for different servers based on their importance in different scenarios. The asset importance score is an important element in the preceding formula. The default value is 1. On the Assets page, you can attach one of the following tags to your assets: Important Assets, General Assets, and Test Assets. The asset importance score varies based on the following types of assets:
  • Important Assets: The asset importance score is 1.5.
  • General Assets: The asset importance score is 1.
  • Test Assets: The asset importance score is 0.5.

Priorities to fix vulnerabilities

You can fix vulnerabilities based on priorities, which are determined by the score of urgency to fix a vulnerability.

The following table describes the mappings between the score of urgency to fix a vulnerability and each priority.
Priority Description Score of urgency to fix a priority Solution
High This priority is assigned to a vulnerability that can be easily exploited by an unauthenticated remote attacker. The vulnerability can be exploited to compromise systems over arbitrary code execution without user interactions. In most cases, this type of vulnerability is exploited by worms or ransomware. Greater than 13.5 We recommend that you fix this type of vulnerability at the earliest opportunity.
Medium This priority is assigned to a vulnerability that may adversely affect the confidentiality, integrity, or availability of resources. In most cases, this type of vulnerability cannot be exploited. However, this type of vulnerability is given a high score by the CVSS when they are disclosed on the Internet or at an official website. We recommend that you attach importance to this type of vulnerability. 7.1 to 13.5 We recommend that you fix this type of vulnerability based on your business requirements.
Low This priority is assigned to a vulnerability that has the lowest possibility of being exploited or does not pose risks after it is exploited. In most cases, this type of vulnerability is a bug in the source code of a program or a vulnerability that affects compliance and service performance. Less than 7 We recommend that you ignore this type of vulnerability.
Note
  • If the environment score of a vulnerability cannot be calculated due to reasons such as network jitters, the priority to fix the vulnerability is Low.
  • Urgent and Web-CMS vulnerabilities are assigned the High priority, which is confirmed by Alibaba Cloud security engineers. We recommend that you fix urgent and Web-CMS vulnerabilities at the earliest opportunity.

Limits

Supported operating systems of vulnerability detection and vulnerability fixing

Operating system Version
CentOS CentOS 5, CentOS 6, CentOS 7, and CentOS 8. For CentOS 5, CentOS 6, and CentOS 8, Security Center can detect and fix only the vulnerabilities that are disclosed before their respective end of life (EOL) date.
Redhat Red Hat 5, Red Hat 6, Red Hat 7, and Red Hat 8. For Red Hat 5 and Red Hat 6, Security Center can detect and fix only the vulnerabilities that are disclosed before their respective EOL date.
Ubuntu Ubuntu 12, Ubuntu 14, Ubuntu 16, Ubuntu 18, Ubuntu 20, and Ubuntu 21. For Ubuntu 12, Ubuntu 14, and Ubuntu 16, Security Center can detect and fix only the vulnerabilities that are disclosed before their respective EOL date.
Windows Server Windows Server 2008, Windows Server 2012, Windows Server 2016, and Windows Server 2019. For Windows Server 2008, Security Center can detect and fix only the vulnerabilities that are disclosed before the EOL date.
Alibaba Cloud Linux Alibaba Cloud Linux 2.1903 and Alibaba Cloud Linux 3.
Anolis OS Anolis OS 7.9 and Anolis OS 8.

Lifecycles of operating systems

If an operating system reaches its EOL, Security Center no longer detects and fixes Linux software vulnerabilities or Windows system vulnerabilities in the operating system. The following table describes the operating systems that are subject to this limit. The vulnerability scan and fixing features for Web-CMS vulnerabilities, application vulnerabilities, and urgent vulnerabilities, and other features of Security Center are not affected.

Operating system version Official EOL date Impact on vulnerability-related features
Windows Server 2003 July 14, 2015 Security Center detects only vulnerabilities that are exposed before July 14, 2015 and applies patches to fix the vulnerabilities. Security Center no longer detects or fixes vulnerabilities that are exposed on and after July 14, 2015.
Windows Server 2008 January 14, 2020 Security Center detects only vulnerabilities that are exposed before January 14, 2020 and applies patches to fix the vulnerabilities. Security Center no longer detects or fixes vulnerabilities that are exposed on and after January 14, 2020.
Windows Server 2008 R2 January 14, 2020 Security Center detects only vulnerabilities that are exposed before January 14, 2020 and applies patches to fix the vulnerabilities. Security Center no longer detects or fixes vulnerabilities that are exposed on and after January 14, 2020.
Windows Server 2008 SP2 January 14, 2020 Security Center detects only vulnerabilities that are exposed before January 14, 2020 and applies patches to fix the vulnerabilities. Security Center no longer detects or fixes vulnerabilities that are exposed on and after January 14, 2020.
Ubuntu 12.04 LTS April 28, 2017 Security Center detects only vulnerabilities that are exposed before April 28, 2017 and applies patches to fix the vulnerabilities. Security Center no longer detects or fixes vulnerabilities that are exposed on and after April 28, 2017.
Ubuntu 14.04 LTS April 2019 Security Center detects only vulnerabilities that are exposed before April 2019 and applies patches to fix the vulnerabilities. Security Center no longer detects or fixes vulnerabilities that are exposed after April 2019.
Ubuntu 16.04 LTS May 2021 Security Center detects only vulnerabilities that are exposed before May 2021 and applies patches to fix the vulnerabilities. Security Center no longer detects or fixes vulnerabilities that are exposed after May 2021.
CentOS 5 March 31, 2017 Security Center detects only vulnerabilities that are exposed before March 31, 2017 and applies patches to fix the vulnerabilities. Security Center no longer detects or fixes vulnerabilities that are exposed on and after March 31, 2017.
CentOS 6 November 30, 2020 Security Center detects only vulnerabilities that are exposed before November 30, 2020 and applies patches to fix the vulnerabilities. Security Center no longer detects or fixes vulnerabilities that are exposed on and after November 30, 2020.
CentOS 8 December 31, 2021 Security Center detects only vulnerabilities that are exposed before December 31, 2021 and applies patches to fix the vulnerabilities. Security Center no longer detects or fixes vulnerabilities that are exposed on and after December 31, 2021.
Redhat 5 March 31, 2017 Security Center detects only vulnerabilities that are exposed before March 31, 2017 and applies patches to fix the vulnerabilities. Security Center no longer detects or fixes vulnerabilities that are exposed on and after March 31, 2017.
Redhat 6 November 30, 2020 Security Center detects only vulnerabilities that are exposed before November 30, 2020 and applies patches to fix the vulnerabilities. Security Center no longer detects or fixes vulnerabilities that are exposed on and after November 30, 2020.

References

How often does Security Center detect vulnerabilities?

What are the differences between baselines and vulnerabilities?

What do I do if I cannot enable the vulnerability detection feature for a server on the Assets page?