Clarification on .NET patches installed on the image

[angaaruriakhil]

Hi,

Thanks for the work on these images. We use the code in this repository monthly to build images for use with VMSS. I'd like to get some clarity on the .NET patches installed on the Windows images.

From the readme, it says, for .NET Core: “2 latest LTS versions and 1 latest version. For each feature version only latest patch is installed”.

Our Qualys scans are flagging up that the following patches are missing:

• Microsoft .NET Core Security Update for January 2024
• Microsoft .NET Security Update for September 2022
• Microsoft .NET Core and ASP.NET Core Security Update for November 2023
• Microsoft .NET Core and ASP.NET Core Security Update for February 2024
• Microsoft .NET Security Update for July 2023
• Microsoft .NET Security Update for June 2023
• Microsoft .NET Security Update for April 2023
• Microsoft .NET Security Update for February 2023
• Microsoft .NET Security Update for December 2022
• Microsoft .NET (NuGet Client) Security Update for October 2022
• Microsoft .NET Framework Update for April 2024
• Microsoft .NET Security Update for April 2024
• Microsoft .NET Security Update for March 2024
• Microsoft .NET Security Update for October 2023
• Microsoft .NET Security Update for September 2023
• Microsoft .NET Security Update for August 2023
• Microsoft .NET Security Update for January 2023
• Microsoft .NET Security Update for August 2022
• Microsoft .NET Security Update for June 2022

It sounds like the latest patches should be getting installed which should cover these, particularly this should be covered in the Install-WindowsUpdate.ps1 script.

Could I kindly request some clarification on if these patches are missing in the image, and how we might appropriately remediate these in our images? Thanks.

[kishorekumar-anchala]

Hi @angaaruriakhil ,

Could you please try with latest release version 20240721.1 .

[angaaruriakhil]

Thank you for addressing this.

We need to do a rebuild, we don't use the MS-hosted agents but build our own VMSS with this repo. But we are facing issue #10331 which prevents us from completing our build.

We are also currently internally transitioning our vulnerability process. We can't run a scan at the moment unfortunately but should be able to again in the coming weeks.

Could you kindly summarise the changes that have been made? I can't see anything relevant in the commits for main, but I may be missing something.

Thanks!

[angaaruriakhil]

Hi, we've been able to perform a Qualys scan of a Windows 2022 agent running an image freshly built today (19-09-2024) using the main branch code in this repo.

Qualys is reporting a number of issues with the image, and the missing patches that we discussed in July are still detected as missing. Is there any update on getting these sorted?

Below is a complete list for Windows 2022.

• Python Extensible Markup Language (XML) External Entity Vulnerability
• EOL/Obsolete Software: Microsoft .Net Core Version 7 Detected
• EOL/Obsolete Software: Python 3.7.x Detected
• Microsoft .NET Core Security Update for January 2024
• PostgreSQL Race Condition Vulnerability (CVE-2024-7348)
• Node.js Network Import Bypass Vulnerability (CVE-2024-22020)
• Node.js Command Injection Flaw Vulnerability (CVE-2024-36138)
• Python Improper Input Validation Vulnerability
• Azure Service Fabric Explorer Spoofing Vulnerability
• Microsoft WinVerifyTrust Signature Validation Vulnerability
• Python 3 Denial of Service (DoS) Vulnerability
• Microsoft .NET Privilege Escalation Vulnerability
• Microsoft .NET Core and ASP.NET Core Security Update for February 2024
• Microsoft .NET Core and ASP.NET Core Security Update for November 2023
• Microsoft HTTP/2 Protocol Distributed Denial of Service (DoS) Vulnerability
• Microsoft .NET Security Update for July 2023
• Microsoft .NET Security Update for June 2023
• Microsoft .NET Security Update for April 2023
• Microsoft .NET Security Update for February 2023
• Microsoft .NET Security Update for December 2022
• Microsoft .NET (NuGet Client) Security Update for October 2022
• Microsoft .NET Security Update for September 2022
• Libcurl Denial of Service (DoS) Vulnerability
• TortoiseSVN Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Vulnerability
• Azure Service Fabric Information Disclosure Vulnerability
• Python Parsing errors in email/_parseaddr.py lead to incorrect value in email address part of tuple
• Python3 RFI/SSRF Vulnerability
• Microsoft .NET Security Update for May 2024
• Microsoft .NET Security Update for April 2024
• Microsoft .NET Security Update for March 2024
• Microsoft .NET Security Update for October 2023
• Microsoft .NET Security Update for September 2023
• Microsoft .NET Security Update for August 2023
• Microsoft .NET Security Update for January 2023
• Microsoft .NET Security Update for August 2022
• Microsoft .NET Security Update for June 2022
• Allowed Null Session
• SMB Signing Disabled or SMB Signing Not Required
• Windows Explorer Autoplay Not Disabled for Default User
• Microsoft Windows Explorer AutoPlay Not Disabled
• Enabled Cached Logon Credential

[kishorekumar-anchala]

Hi @angaaruriakhil ,

#10331 already got fixed .

coming to .net patches , i will try to share the workaround once i finished the investigation. thank you for support !

[kishorekumar-anchala]

Hi @angaaruriakhil ,

Install-WindowsUpdates.ps1 - this script will manage all the updates about Windows . it will help to install latest patches whcih are not installed. few patches are we have to install manually ( By modifying the script ) .

By using Get-WindowsUpdate Function , it checks for all available updates. If there are updates that are not installed, the script will attempt to install them. After installation, it verifies if the updates were successful by checking their installation state.

Run the Install-WindowsUpdates.ps1 script after the Install-DotnetSDK.ps1 script to ensure that all Windows updates.

[angaaruriakhil]

Hi, we consume the same packer template from this repo and execute the scripts in the same order, with very minimal edits. We are executing the windows update script after the dot net sdk script as in the template

[Alexey-Ayupov]

Hello @angaaruriakhil. All of our Windows images have the "Configure Automatic Updates" GPO setting set to Not Configured, which means that additional setting "Install Updates for other Microsoft Products" is also disabled. It could be potentially a reason why you can see skipped updates during Qualys scan.
However, we have enabled this parameter ("Install Updates for other Microsoft Products" ) in the test environment and did not get any new updates.
You should bear in mind that for each image generation process we use Microsoft Azure Marketplace images what have their own update cadency including security updates.

You could tweak registry settings and check what you will have, but do not forget to turn off the Automatic Updates on your images, with the settings below it could be a problem in a future.

Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' -Name 'AllowMUUpdateService' -Value 1
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' -Name 'NoAutoUpdate' -Value 0
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' -Name 'AUOptions' -Value 3
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' -Name 'ScheduledInstallDay' -Value 0
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' -Name 'ScheduledInstallTime' -Value 3