Fixing Vulnerabilities and Verifying the Result

Precautions

• Vulnerability fixing operations cannot be rolled back. If a vulnerability fails to be fixed, services will probably be interrupted, and incompatibility issues will probably occur in middleware or upper layer applications. To avoid unrecoverable errors, you are advised to use Cloud Server Backup Service (CSBS) to back up your servers. Then, use idle servers to simulate the production environment and test-fix the vulnerability. If the test-fix succeeds, fix the vulnerability on servers running in the production environment.
• Servers need to access the Internet and use external image sources to fix vulnerabilities.

Urgency

• High: This vulnerability must be fixed as soon as possible. Attackers may exploit this vulnerability to damage the server.
• Medium: You are advised to fix the vulnerability to enhance your server security.
• Safe for now: This vulnerability has a small threat to server security. You can choose to fix or ignore it.

Vulnerability Display

• Vulnerabilities that failed to be fixed or have not been handled are always displayed in the vulnerability list.
• Fixed vulnerabilities will remain in the list within 30 days after it was fixed.

Fixing Vulnerabilities in One Click

1. Log in to the management console.
2. In the upper left corner of the page, select a region, click , and choose Security > Host Security Service.
3. On the Vulnerabilities page, click Fix. The Affected Servers tab is displayed, as shown in Figure 1.

   Figure 1 Fixing vulnerabilities

   
   

4. Select the affected servers and click Fix.

   Figure 2 One-click vulnerability fix

   
   

5. In the dialog box that is displayed, select I am aware that if I have not backed up my ECSs before fixing vulnerabilities, services may be interrupted and fail to be rolled back during maintenance.
6. Click OK to fix the vulnerability in one-click mode. The vulnerability status will change to Fixing.

   If a vulnerability is fixed, its status will change to Repaired. If it fails to be fixed, its status will change to Failed.

   Note

   Restart the system after you fixed a Windows OS or Linux kernel vulnerability, or HSS will probably continue to warn you of this vulnerability.

Manually Fixing Software Vulnerabilities

• Fix the vulnerabilities in sequence based on the suggestions.
• If multiple software packages on the same server have the same vulnerability, you only need to fix the vulnerability once.

Method 1: Create a VM to fix the vulnerability.

1. Create an image for the ECS to be fixed.
2. Use the image to create an ECS.
3. Fix the vulnerability on the new ECS and verify the result.
4. Switch services over to the new ECS and verify they are stably running.
5. Release the original ECS. If a fault occurs after the service switchover and cannot be rectified, you can switch services back to the original ECS.

Method 2: Fix the vulnerability on the target server.

1. Create a backup for the ECS to be fixed.
2. Fix vulnerabilities on the current server.
3. If services become unavailable after the vulnerability is fixed and cannot be recovered in a timely manner, use the backup to restore the server.

Ignoring Vulnerabilities

Verifying Vulnerability Fix

• Click Verify on the vulnerability details page.
• Ensure the software has been upgraded to the latest version. The following table provides the commands to check the software upgrade result.

  Table 2 Verification commands

  OS	Verification Command
  CentOS/Fedora/EulerOS/Red Hat/Oracle	rpm -qa | grep Software_name
  Debian/Ubuntu	dpkg -l | grep Software_name
  Gentoo	emerge --search Software_name
  SUSE	zypper search -dC --match-words Software_name

• Manually check for vulnerabilities and view the vulnerability fixing results.