Versions Compared

Old Version 9

changes.mady.by.user inoue

Saved on

compared with

New Version Current

changes.mady.by.user inoue

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Test document

Robot_based_on_SSES_BP_Test_document.pdf


*The following word file is base file of the above pdf.

View file
nameRobot_based_on_SSES_BP_Test_document.docx
height250

...

Pass (16/16 test cases)

Vuls

Nexus URL: TBDThere are 17 https://nexus.akraino.org/content/sites/logs/fujitsu/job/robot-family/sses-vuls/

IoT Gateway

There are 23 CVEs with a CVSS score >= 9.0. These are exceptions requested here:

Release 5: Akraino CVE Vulnerability Exception Request

CVE-ID

CVSS

NVD

Fix/Notes

PACKAGES

CVE-

2005

2016-

2541

1585

10

9.

0

8

https://nvd.nist.gov/vuln/detail/CVE-
2005
2016-
2541
1585
unfixed

No fix available

tar

apparmor

CVE-

2014

2017-

2830

18201

10

9.

0

8

https://nvd.nist.gov/vuln/detail/CVE-
2014
2017-
2830cifs-utils
18201

unfixed

No fix available

libcdio17

CVE-

2016

2017-

1585

7827

9.8

https://nvd.nist.gov/vuln/detail/CVE-
2016
2017-
1585
7827

unfixed

libapparmor1

No fix available

libmozjs-52-0

CVE-

2017

2018-

17479

5090

9.8

https://nvd.nist.gov/vuln/detail/CVE-
2017
2018-
17479

unfixed

libopenjp2-7
5090

Reported fixed in 58 and later version (installed), but still reported by Vuls

libmozjs-52-0

CVE-

2017

2018-

9117

5126

9.8

https://nvd.nist.gov/vuln/detail/CVE-
2017
2018-
9117

unfixed

libtiff5
5126

Reported fixed in 58 and later version (installed), but still reported by Vuls

libmozjs-52-0

CVE-2018-

13410

5145

9.8

https://nvd.nist.gov/vuln/detail/CVE-2018-
13410

unfixed

zip
5145

Reported fixed in 1:52.7.0 and later version (installed), but still reported by Vuls

libmozjs-52-0

CVE-

2019

2018-

1010022

5151

9.8

https://nvd.nist.gov/vuln/detail/CVE-
2019
2018-
1010022

unfixed

libc-bin, libc-dev-bin, libc-devtools, libc-l10n, libc6, libc6-dbg, libc6-dev, locales
5151

Reported fixed in 60 and later version (installed), but still reported by Vuls

libmozjs-52-0

CVE-2019-

8341

17041

9.8

https://nvd.nist.gov/vuln/detail/CVE-2019-
8341
17041

unfixed

python3-jinja2

No fix available

rsyslog

CVE-

2020

2019-

27619

17042

9.8

https://nvd.nist.gov/vuln/detail/CVE-
2020
2019-
27619python3.9
17042

unfixed

No fix available

rsyslog

CVE-2021-

29462

31870

9.8

https://nvd.nist.gov/vuln/detail/CVE-2021-
29462
31870

unfixed

libixml10, libupnp13

No fix available

klibc-utils, libklibc

CVE-2021-

29921

31872

9.8

https://nvd.nist.gov/vuln/detail/CVE-2021-
29921python3.9
31872

unfixed

No fix available

klibc-utils, libklibc

CVE-2021-

30473

31873

9.8

https://nvd.nist.gov/vuln/detail/CVE-2021-
30473CVE-2021-30474
31873

unfixed

libaom0

No fix available

klibc-utils, libklibc

CVE-2021-39713

9.8

https://nvd.nist.gov/vuln/detail/CVE-2021-
30474

CVE-2021-30475

9.8

https://nvd.nist.gov/vuln/detail/CVE-2021-30475

unfixed

libaom0

CVE-2021-30498
39713

unfixed

libaom0

No fix available

linux-image-5.4.0-1055-raspi

CVE-2022-22822

9.8

https://nvd.nist.gov/vuln/detail/CVE-
2021
2022-
30498

unfixed

libcaca0
22822

install firefox 99.0+build2-0ubuntu0.18.04.2 > 98(fix version)

firefox

CVE-

2021

2022-

30499

22823

9.8

https://nvd.nist.gov/vuln/detail/CVE-
2021
2022-
30499

unfixed

libcaca0
22823

install firefox 99.0+build2-0ubuntu0.18.04.2 > 98(fix version)

firefox

CVE-

2021

2022-

3756

22824

9.8

https://nvd.nist.gov/vuln/detail/CVE-
2021
2022-
3756

unfixed

libmysofa1
22824

install firefox 99.0+build2-0ubuntu0.18.04.2 > 98(fix version)

firefox

CVE-

2021

2022-

42377

23852

9.8

https://nvd.nist.gov/vuln/detail/CVE-
2021
2022-
42377
23852

unfixed

busybox

No fix available

firefox, thunderbird

CVE-

2021

2022-

45951

23990

9.8

https://nvd.nist.gov/vuln/detail/CVE-
2021
2022-
45951
23990

unfixed

dnsmasq

No fix available

firefox, thunderbird

CVE-

2021

2022-

45952

25235

9.8

https://nvd.nist.gov/vuln/detail/CVE-
2021
2022-
45952dnsmasq
25235

unfixed

No fix available

firefox, thunderbird

CVE-

2021

2022-

45953

25236

9.8

https://nvd.nist.gov/vuln/detail/CVE-
2021
2022-
45953dnsmasq
25236

unfixed

No fix available

firefox, thunderbird

CVE-

2021

2022-

45954

25315

9.8

https://nvd.nist.gov/vuln/detail/CVE-
2021
2022-
45954dnsmasq
25315

unfixed

No fix available

firefox, thunderbird

CVE-

2021

2016-

45955

9180

9.

8

1

https://nvd.nist.gov/vuln/detail/CVE-
2021
2016-
45955dnsmasq
9180

unfixed

No fix available

libxml-twig-perl

CVE-

2021

2019-

45956

20433

9.

8

1

https://nvd.nist.gov/vuln/detail/CVE-
2021
2019-
45956
20433
unfixed9.8

No fix available

dnsmasq

CVE-2022-0318

9.8

https://nvd.nist.gov/vuln/detail/CVE-2022-0318

unfixed

vim

CVE-2022-23303

aspell

PC/Server for robot control

There are 30 CVEs with a CVSS score >= 9.0. These are exceptions requested here:

Release 5: Akraino CVE Vulnerability Exception Request


CVE-ID

CVSS

NVD

Fix/Notes

PACKAGES

CVE-2005-2541

10.0

https://nvd.nist.gov/vuln/detail/CVE-
2022
2005-
23303hostapd, wpasupplicant
2541

unfixed

No fix available

tar

CVE-

2022

2014-

23304

2830

9

10.

8

0

https://nvd.nist.gov/vuln/detail/CVE-
2022
2014-
23304hostapd, wpasupplicant
2830

unfixed

No fix available

cifs-utils

CVE-

2021

2016-

22945

1585

9.

1

8

https://nvd.nist.gov/vuln/detail/CVE-
2021
2016-
22945
1585
unfixed
No fix available
curl

libapparmor1

CVE-

2021

2017-

4048

17479

9.

1

8

https://nvd.nist.gov/vuln/detail/CVE-
2021
2017-
4048libblas3, liblapack3
17479

unfixed

No fix available

libopenjp2-7

CVE-

2021

2017-

43400

9117

9.

1

8

https://nvd.nist.gov/vuln/detail/CVE-
2021
2017-
43400
9117
unfixed
No fix available

bluez

Lynis

...

libtiff5

CVE-2018-13410

9.8

https://nvd.nist.gov/vuln/detail/CVE-2018-13410No fix available

zip

CVE-2019-1010022

9.8

https://nvd.nist.gov/vuln/detail/CVE-2019-1010022No fix available

libc-bin, libc-dev-bin, libc-devtools, libc-l10n, libc6, libc6-dbg, libc6-dev, locales

CVE-2019-8341

9.8

https://nvd.nist.gov/vuln/detail/CVE-2019-8341No fix available

python3-jinja2

CVE-2020-27619

9.8

https://nvd.nist.gov/vuln/detail/CVE-2020-27619

No fix available

python3.9

CVE-2021-29462

9.8

https://nvd.nist.gov/vuln/detail/CVE-2021-29462No fix available

libixml10, libupnp13

CVE-2021-29921

9.8

https://nvd.nist.gov/vuln/detail/CVE-2021-29921Reported fixed in python3.9 (installed), but still reported by Vuls

python3.9

CVE-2021-30473

9.8

https://nvd.nist.gov/vuln/detail/CVE-2021-30473No fix available

libaom0

CVE-2021-30474

9.8

https://nvd.nist.gov/vuln/detail/CVE-2021-30474No fix available

libaom0

CVE-2021-30475

9.8

https://nvd.nist.gov/vuln/detail/CVE-2021-30475No fix available

libaom0

CVE-2021-30498

9.8

https://nvd.nist.gov/vuln/detail/CVE-2021-30498No fix available

libcaca0

CVE-2021-30499

9.8

https://nvd.nist.gov/vuln/detail/CVE-2021-30499No fix available

libcaca0

CVE-2021-3756

9.8

https://nvd.nist.gov/vuln/detail/CVE-2021-3756install libmysofa 1.2.1

libmysofa1

CVE-2021-42377

9.8

https://nvd.nist.gov/vuln/detail/CVE-2021-42377No fix available

busybox

CVE-2021-45951

9.8

https://nvd.nist.gov/vuln/detail/CVE-2021-45951No fix available

dnsmasq

CVE-2021-45952

9.8

https://nvd.nist.gov/vuln/detail/CVE-2021-45952No fix available

dnsmasq

CVE-2021-45953

9.8

https://nvd.nist.gov/vuln/detail/CVE-2021-45953No fix available

dnsmasq

CVE-2021-45954

9.8

https://nvd.nist.gov/vuln/detail/CVE-2021-45954No fix available

dnsmasq

CVE-2021-45955

9.8

https://nvd.nist.gov/vuln/detail/CVE-2021-45955No fix available

dnsmasq

CVE-2021-45956

9.8

https://nvd.nist.gov/vuln/detail/CVE-2021-45956No fix available

dnsmasq

CVE-2022-0318

9.8

https://nvd.nist.gov/vuln/detail/CVE-2022-0318unistall vim

vim

CVE-2022-23303

9.8

https://nvd.nist.gov/vuln/detail/CVE-2022-23303No fix available

hostapd, wpasupplicant

CVE-2022-23304

9.8

https://nvd.nist.gov/vuln/detail/CVE-2022-23304No fix available

hostapd, wpasupplicant

CVE-2021-22945

9.1

https://nvd.nist.gov/vuln/detail/CVE-2021-22945unistall curl

curl

CVE-2021-4048

9.1

https://nvd.nist.gov/vuln/detail/CVE-2021-4048No fix available

libblas3, liblapack3

CVE-2021-43400

9.1

https://nvd.nist.gov/vuln/detail/CVE-2021-43400No fix available

bluez

Lynis

Nexus URL(before fix): https://nexus.akraino.org/content/sites/logs/fujitsu/job/robot-family/sses-lynis/11

Nexus URL(after fix): https://nexus.akraino.org/content/sites/logs/fujitsu/job/robot-family/sses-lynis/3


The initial results compare with the Lynis Incubation: PASS/FAIL Criteria, v1.0 as follows.

IoT Gateway

The Lynis Program Update test MUST pass with no errors.

Code Block
2022-03-29 22:55:42 Test: Checking for program update...
2022-03-29 22:55:43 Current installed version  : 308
2022-03-29 22:55:43 Latest stable version      : 307
2022-03-29 22:55:43 No Lynis update available.

...

Fix: Download and run the latest Lynis directly on SUT.

Steps To Implement Security Scan Requirements#InstallandExecute

The following list of tests MUST complete as passing
No.TestResultFix
1Test: Checking PASS_MAX_DAYS option in /etc/login.defsResult: password aging limits are not configured
Suggestion: Configure maximum password age in /etc/login.defs [test:AUTH-9286] [details:-] [solution:-]
Hardening: assigned partial number of hardening points (0 of 1). Currently having 13 points (out of 28)		Set PASS_MAX_DAYS 180 in /etc/login.defs
2Performing test ID AUTH-9328 (Default umask values)Test: Checking umask value in /etc/login.defs
Result: found umask 022, which could be improved
Suggestion: Default umask in /etc/login.defs could be more strict like 027 [test:AUTH-9328] [details:-] [solution:-]		Set UMASK 027 in /etc/login.defs
3Performing test ID SSH-7440 (Check OpenSSH option: AllowUsers and AllowGroups)Result: AllowUsers is not set
Result: AllowGroups is not set
Result: SSH has no specific user or group limitation. Most likely all valid users can SSH to this machine.
Hardening: assigned partial number of hardening points (0 of 1). Currently having 140 points (out of 217)
Security check: file is normal
Checking permissions of /home/ubuntu/lynis/include/tests_snmp
File permissions are OK		Configure AllowUsers, AllowGroups in /etc/ssh/sshd_config
4Test: checking for file /etc/network/if-up.d/ntpdateResult: file /etc/network/if-up.d/ntpdate does not exist
Result: Found a time syncing daemon/client.
Hardening: assigned maximum number of hardening points for this item (3). Currently having 149 points (out of 232)		OK
5Performing test ID KRNL-6000 (Check sysctl key pairs in scan profile) :  Following sub-tests requiredN/AN/A
5asysctl key fs.suid_dumpable contains equal expected and current value (0)Result: sysctl key fs.suid_dumpable has a different value than expected in scan profile. Expected=0, Real=2
Hardening: assigned partial number of hardening points (0 of 1). Currently having 151 points (out of 247)		Set recommended value in /etc/sysctl.d/90-lynis-hardening.conf

echo 'fs.suid_dumpable=0' | sudo tee -a /etc/sysctl.d/90-lynis-hardening.conf
sudo /sbin/sysctl --system
sudo sysctl -a |grep suid
5bsysctl key kernel.dmesg_restrict contains equal expected and current value (1)Result: sysctl key kernel.dmesg_restrict has a different value than expected in scan profile. Expected=1, Real=0Set recommended value in /etc/sysctl.d/90-lynis-hardening.conf

echo 'kernel.dmesg_restrict=1' | sudo tee -a /etc/sysctl.d/90-lynis-hardening.conf
sudo /sbin/sysctl --system
sudo sysctl -a |grep dmesg
5csysctl key net.ipv4.conf.default.accept_source_route contains equal expected and current value (0)Result: sysctl key net.ipv4.conf.default.accept_source_route has a different value than expected in scan profile. Expected=0, Real=1Set recommended value in /etc/sysctl.d/90-lynis-hardening.conf

echo 'net.ipv4.conf.default.accept_source_route=0' | sudo tee -a /etc/sysctl.d/90-lynis-hardening.conf
sudo /sbin/sysctl --system
sudo sysctl -a |grep ipv4.conf.default.accept_source_route
6Test: Check if one or more compilers can be found on the systemResult: found installed compiler. See top of logfile which compilers have been found or use /bin/grep to filter on 'compiler'
Hardening: assigned partial number of hardening points (1 of 3). Currently having 168 points (out of 280)		Uninstall gcc and remove /usr/bin/as



PC/Server for robot control

The Lynis Program Update test MUST pass with no errors.

Code Block
2022-03-23 05:13:56 Test: Checking for program update...
2022-03-23 05:14:03 Current installed version : 308
2022-03-23 05:14:03 Latest stable version : 307
2022-03-23 05:14:03 No Lynis update available

...

Fix: Download and run the latest Lynis directly on SUT.

Steps To Implement Security Scan Requirements#InstallandExecute

The following list of tests MUST complete as passing

...