tema Re: Vunerabilidades en Smart Net Total Care Portal and Collector Discussions

Vunerabilidades

AC4 — Thu, 26 Sep 2019 21:41:20 GMT

Hola comunidad:

Tengo un colector 2.1.4 al cual se le encontraron varias vulnerabilidades:

Asset IP Address	Asset OS Name	Vulnerability ID	Vulnerability Severity Level	Asset Risk Score	Vulnerability Risk Score
10.223.254.70	Linux	suse-wrong-file-permissions	4	3.347	668
10.223.254.70	Linux	unix-anonymous-root-logins	7	3.347	724
10.223.254.70	Linux	unix-dot-entries-in-root-path	4	3.347	721
10.223.254.70	Linux	unix-unowned-files-or-dirs	2	3.347	568
10.223.254.70	Linux	unix-world-writable-files	4	3.347	667

Como puedo resolverlas?

Adolfo Cabrera

Re: Vunerabilidades

luis_cordova — Thu, 26 Sep 2019 21:57:22 GMT

Hola @AC4 ,

Te sugiero investigar el ID de las vulnerabilidades, pues ahí se te está indicando la vulnerabilidad.

Por ejemplo, ante la vulnerabilidad "suse-wrong-file-permissions", yo revisaría los permisos de los archivos en tu sistema suse.

Saludos

Re: Vunerabilidades

AC4 — Wed, 02 Oct 2019 21:11:51 GMT

Hola luis:

Anexo información enviada por el cliente para que por favor me indique como reparar las vulnerabilidades.

Adolfo

Re: Vunerabilidades

adias — Wed, 02 Oct 2019 22:05:26 GMT

What is the version of the Collector CSPC

If you connect via admin CLI send me the output of the command below:

admin# show ver -d

Re: Vunerabilidades

AC4 — Thu, 03 Oct 2019 20:13:45 GMT

Hola Adias:

Re: Vunerabilidades

adias — Thu, 03 Oct 2019 20:52:16 GMT

the collector must be upgraded to 2.8.1.6.. most of the vulnerabilities mentioned will be mitigated then. please upgrade the collector and re-run the scan to confirm.

EXAMPLES.

and

https://www.cisco.com/c/en/us/support/cloud-systems-management/common-services-platform-collector-cspc/products-release-notes-list.html

Re: Vunerabilidades

adias — Fri, 18 Oct 2019 17:50:20 GMT

Hello Luis have the post provided the answers you needed, if so please mark as resolved for other to benefit and that I can take it of from my monitoring posts. If you still have additional questions please let me know