topic Re: remediating vulnerabilities in Expedition Discussions

remediating vulnerabilities

rodill — Thu, 04 Mar 2021 14:41:46 GMT

My scanning team keeps finding vulnerabilities on Expedition and keep requesting I patch them. They all seem to be related to Linux not Expedition itself. I know that I can't upgrade the version of Ubuntu that it runs on. Suggestions?

list of some of the vulnerabilities

Apache

CVE-2017-15715

CVE-2016-8743

CVE-2019-0211

CVE-2018-1333

CVE-2016-2161

CVE-2016-8740

CVE-2016-5387

CVE-2017-15710

CVE-2016-0736

CVE-2018-1303

CVE-2016-4979

CVE-2017-9798

CVE-2019-0217

CVE-2018-17199

Re: remediating vulnerabilities

azuniga — Thu, 04 Mar 2021 17:06:52 GMT

Hello @rodill

Update your apache2 service to patch these vulnerabilities. The latest version of apache2 is running on 2.4.46 so I used that in this example and after you restart apache2 it should be reachable, and please back up the VM if for any event you have problems after the upgrade.

sudo add-apt-repo ppa:ondrej/apache2
sudo apt-get install apache2=2.4.46-2+ubuntu16.04.1+deb.sury.org+3
apache2 -v (it is now on the latest)
sudo service apache2 restart

Re: remediating vulnerabilities

rodill — Thu, 04 Mar 2021 20:37:18 GMT

thanks for the suggestions. The first command doesn't comeback as a valid command. The expedition is just as Palo supplied it if that matters in this instance. I run the version check and I get this

Server version: Apache/2.4.18 (Ubuntu)
Server built: 2020-08-12T21:35:50

Re: remediating vulnerabilities

azuniga — Thu, 04 Mar 2021 20:42:09 GMT

Hello @rodill

The first command is reaching out to a remote repository please make sure if you are running a proxy it has access to communicate with it. The Apache Version is 2.4.18 so when you run what I suggested then you should now be on 2.4.46 when you run the version check.

Re: remediating vulnerabilities

rodill — Thu, 04 Mar 2021 20:50:22 GMT

thanks to your suggestions I found I needed to run this

sudo add-apt-repository ppa:ondrej/apache2
sudo apt update
sudo apt upgrade
sudo apt-get dist-upgrade

this did the trick for me on the upgrade, will wait on the scanning team, thanks again

Re: remediating vulnerabilities

azuniga — Thu, 04 Mar 2021 20:52:17 GMT

Hello @rodill,

You are not supposed to run any upgrade on the Ubuntu image that is why I did not include that in my commands, it will break the expedition parser.

Re: remediating vulnerabilities

rodill — Thu, 04 Mar 2021 21:13:34 GMT

so that worked on one of my expedition boxes, but when I try to upgrade the other I get error after apt upgrade

Err:1 http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu xenial/main amd64 python3-gdbm amd64 3.6.5-3~16.04.york4
403 Forbidden [IP: 91.189.95.85 80]
E: Failed to fetch http://ppa.launchpad.net/jonathonf/python-3.6/ubuntu/pool/main/p/python3-stdlib-extensions/python3-gdbm_3.6.5-3~16.04.york4_amd64.deb 403 Forbidden [IP: 91.189.95.85 80]

E: Unable to fetch some archives, maybe run apt-get update or try with --fix-missing?

suggestions?

Re: remediating vulnerabilities

azuniga — Thu, 04 Mar 2021 21:25:29 GMT

Hello @rodill

Can you run another update and tee the output log file so I can view it in it's entirety?

sudo apt-get update | tee update.log

Re: remediating vulnerabilities

rodill — Thu, 04 Mar 2021 22:24:39 GMT

Re: remediating vulnerabilities

rodill — Thu, 04 Mar 2021 22:45:07 GMT

Re: remediating vulnerabilities

rodill — Thu, 04 Mar 2021 22:45:47 GMT

Re: remediating vulnerabilities

rodill — Thu, 04 Mar 2021 22:46:25 GMT

Re: remediating vulnerabilities

rodill — Thu, 04 Mar 2021 22:47:17 GMT

tried to get it all in there, was too big to post

Re: remediating vulnerabilities

azuniga — Thu, 04 Mar 2021 23:26:36 GMT

Hello @rodill

That may not mean anything as there is no release file from the repo, are you facing any errors after doing all of that? Please keep in mind since you upgraded ubuntu 16.04 it may cause problems with the expedition server and if that happens you will need to reinstall expedition on a fresh ubuntu 16.04.

Re: remediating vulnerabilities

rodill — Thu, 04 Mar 2021 23:33:00 GMT

I haven't update the OS, this is how it came out of the box from palo

Welcome to Ubuntu 16.04.6 LTS (GNU/Linux 4.4.0-203-generic x86_64)

* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage

* Introducing self-healing high availability clusters in MicroK8s.
Simple, hardened, Kubernetes for production, from RaspberryPi to DC.

https://microk8s.io/high-availability

62 packages can be updated.
2 updates are security updates.

New release '18.04.5 LTS' available.
Run 'do-release-upgrade' to upgrade to it.

it matches what we have on the test box

Welcome to Ubuntu 16.04.6 LTS (GNU/Linux 4.4.0-203-generic x86_64)

* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/advantage

* Introducing self-healing high availability clusters in MicroK8s.
Simple, hardened, Kubernetes for production, from RaspberryPi to DC.

https://microk8s.io/high-availability

46 packages can be updated.
0 updates are security updates.

New release '18.04.5 LTS' available.
Run 'do-release-upgrade' to upgrade to it.

Re: remediating vulnerabilities

rodill — Thu, 04 Mar 2021 23:41:07 GMT

run this on the test machine and I get this

expedition@Expedition:~$ sudo apt upgrade
Reading package lists... Done
Building dependency tree
Reading state information... Done
Calculating upgrade... Done
The following packages have been kept back:
libmariadbclient18 libmysqlclient18 mariadb-client mariadb-client-10.1 mariadb-client-core-10.1 mariadb-server mariadb-server-10.1 mariadb-server-core-10.1
The following packages will be upgraded:
expedition-beta
1 upgraded, 0 newly installed, 0 to remove and 8 not upgraded.
Need to get 43.7 MB of archives.
After this operation, 0 B of additional disk space will be used.
Do you want to continue? [Y/n]

but on my production machine I get this

expedition@Expedition:~$ sudo apt upgrade
Reading package lists... Done
Building dependency tree
Reading state information... Done
Calculating upgrade... Done
The following package was automatically installed and is no longer required:
liblua5.1-0
Use 'sudo apt autoremove' to remove it.
The following NEW packages will be installed:
libbrotli1 libjansson4 liblua5.2-0 libnghttp2-14 libssl1.1 motd-news-config
The following packages have been kept back:
libmariadbclient18 libmysqlclient18 mariadb-client mariadb-client-10.1 mariadb-client-core-10.1 mariadb-server mariadb-server-10.1 mariadb-server-core-10.1
The following packages will be upgraded:
apache2 apache2-bin apache2-data apache2-utils base-files cloud-guest-utils galera-3 grub-common grub-legacy-ec2 grub-pc grub-pc-bin grub2-common initramfs-tools initramfs-tools-bin
initramfs-tools-core libapr1 libaprutil1 libaprutil1-dbd-sqlite3 libaprutil1-ldap libfastjson-dev libfastjson4 libgeoip1 libgnutls-openssl27 libgnutls30 libpam-modules libpam-modules-bin
libpam-runtime libpam-systemd libpam0g libpython3.6-minimal libpython3.6-stdlib libsystemd0 libudev1 mariadb-common mysql-common openssh-client openssh-server openssh-sftp-server openssl
python3-distupgrade python3-gdbm python3.6 python3.6-minimal python3.7-distutils python3.7-lib2to3 rsyslog sosreport systemd systemd-sysv ubuntu-keyring ubuntu-minimal ubuntu-release-upgrader-core
ubuntu-server ubuntu-standard udev update-notifier-common
56 upgraded, 6 newly installed, 0 to remove and 8 not upgraded.
Need to get 16.1 kB/29.9 MB of archives.
After this operation, 8,466 kB of additional disk space will be used.
Do you want to continue? [Y/n] y

and it fails when I hit y

Re: remediating vulnerabilities

azuniga — Thu, 04 Mar 2021 23:46:50 GMT

Hello @rodill

Do you have the same repo lists on both boxes?

/etc/apt/sources.list.d/

Re: remediating vulnerabilities

rodill — Fri, 05 Mar 2021 02:53:22 GMT

test box

expedition@Expedition:~$ ls /etc/apt/sources.list.d/
adiscon-ubuntu-v8-stable-xenial.list

deadsnakes-ubuntu-ppa-xenial.list

ex-repo.list

jonathonf-ubuntu-python-3_6-xenial.list ondrej-ubuntu-apache2-xenial.list

rabbitmq.list.save
adiscon-ubuntu-v8-stable-xenial.list.save

deadsnakes-ubuntu-ppa-xenial.list.save

ex-repo.list.save

jonathonf-ubuntu-python-3_6-xenial.list.save r

abbitmq.list

prod box

expedition@Expedition:~$ ls /etc/apt/sources.list.d/
adiscon-ubuntu-v8-stable-xenial.list

deadsnakes-ubuntu-ppa-xenial.list.save

jonathonf-ubuntu-python-3_6-xenial.list

ondrej-ubuntu-apache2-xenial.list.save
adiscon-ubuntu-v8-stable-xenial.list.save

ex-repo.list

jonathonf-ubuntu-python-3_6-xenial.list.save

rabbitmq.list
deadsnakes-ubuntu-ppa-xenial.list

ex-repo.list.save

ondrej-ubuntu-apache2-xenial.list

rabbitmq.list.save

Re: remediating vulnerabilities

azuniga — Fri, 05 Mar 2021 15:36:53 GMT

Hello @rodill

It might be better to have a session when you have time, please reach out to fwmigrate@paloaltonetworks.com and ask for me so I can set something up.