Release/release 3.5.1 fixes (#356)

* Add fixes for issues found in the 3.5.1 release

Author: RichardHNetwrix

PingCastle/Healthcheck/HotFixCollector.cs

@@ -8,13 +8,11 @@ namespace PingCastle.Healthcheck
 {
     public class HotFixCollector : IHotFixCollector
     {
-        private readonly IHotfixService _cimService;
-        private readonly IHotfixService _wmiService;
+        private readonly IHotfixService _hotfixService;
 
-        public HotFixCollector(IHotfixService cimService, IHotfixService wmiService)
+        public HotFixCollector(IHotfixService hotfixService)
         {
-            _cimService = cimService ?? throw new System.ArgumentNullException(nameof(cimService));
-            _wmiService = wmiService ?? throw new System.ArgumentNullException(nameof(wmiService));
+            _hotfixService = hotfixService ?? throw new System.ArgumentNullException(nameof(hotfixService));
         }
 
         public HotfixQueryResult GetInstalledHotfixes(string hostName, bool isPrivilegedMode = true, CancellationToken cancellationToken = default)
@@ -35,36 +33,17 @@ public HotfixQueryResult GetInstalledHotfixes(string hostName, bool isPrivileged
                 return new HotfixQueryResult { Status = HotfixQueryStatus.ConnectionFailed, FailureReason = "Invalid hostname" };
             }
 
-            var cimResult = _cimService.TryGetInstalledHotfixes(hostName, ui, cancellationToken);
-            if (cimResult.Status == HotfixQueryStatus.Success)
+            var result = _hotfixService.TryGetInstalledHotfixes(hostName, ui, cancellationToken);
+            if (result.Status == HotfixQueryStatus.Success)
             {
-                Trace.WriteLine($"CIM succeeded for {hostName.SanitizeForLog()} with {cimResult.KbNumbers.Count} hotfixes");
-                return cimResult;
+                Trace.WriteLine($"Retrieved {result.KbNumbers.Count} hotfixes from {hostName.SanitizeForLog()}");
             }
-
-            Trace.WriteLine($"CIM failed for {hostName.SanitizeForLog()} with status {cimResult.Status}: {cimResult.FailureReason}");
-
-            if (cimResult.Status == HotfixQueryStatus.AccessDenied)
-            {
-                Trace.WriteLine($"Skipping WMI fallback for {hostName.SanitizeForLog()} - same credentials would fail");
-                return cimResult;
-            }
-
-            if (cimResult.Status == HotfixQueryStatus.ConnectionFailed || cimResult.Status == HotfixQueryStatus.Timeout || cimResult.Status == HotfixQueryStatus.NoResults)
+            else
             {
-                Trace.WriteLine($"Attempting WMI fallback for {hostName.SanitizeForLog()}");
-                var wmiResult = _wmiService.TryGetInstalledHotfixes(hostName, ui, cancellationToken);
-                if (wmiResult.Status == HotfixQueryStatus.Success)
-                {
-                    Trace.WriteLine($"WMI fallback succeeded for {hostName.SanitizeForLog()} with {wmiResult.KbNumbers.Count} hotfixes");
-                    return wmiResult;
-                }
-
-                Trace.WriteLine($"WMI fallback also failed for {hostName.SanitizeForLog()} with status {wmiResult.Status}: {wmiResult.FailureReason}");
-                return wmiResult;
+                Trace.WriteLine($"Hotfix detection failed for {hostName.SanitizeForLog()} with status {result.Status}: {result.FailureReason}");
             }
 
-            return cimResult;
+            return result;
         }
     }
 }

PingCastle/Healthcheck/HotFixCollectorFactory.cs

@@ -4,12 +4,8 @@ namespace PingCastle.Healthcheck;
 
 public static class HotFixCollectorFactory
 {
-    /// <summary>
-    /// Creates a new instance of HotFixCollector with CIM as primary and WMI as fallback.
-    /// </summary>
-    /// <returns>A new HotFixCollector instance</returns>
     public static HotFixCollector Create()
     {
-        return new HotFixCollector(new CimHotfixHelper(), new WmiHotfixHelper());
+        return new HotFixCollector(new WmiHotfixHelper());
     }
-}
+}

PingCastle/misc/CimHotfixHelper.cs

@@ -1,6 +1,7 @@
 using System;
 using System.Collections.Generic;
 using System.Diagnostics;
+using System.Globalization;
 using System.Management;
 using System.Text.RegularExpressions;
 using System.Threading;
@@ -146,7 +147,8 @@ private bool TryGetHotfixesFromQuickFixEngineering(string hostName, HotfixQueryR
         private static void CheckPostAlertQualityUpdate(ManagementObject obj, HotfixQueryResult result, DateTime alertCutoff)
         {
             var description = obj["Description"]?.ToString();
-            if (!string.Equals(description, "Update", StringComparison.OrdinalIgnoreCase))
+            if (!string.Equals(description, "Update", StringComparison.OrdinalIgnoreCase) &&
+                !string.Equals(description, "Security Update", StringComparison.OrdinalIgnoreCase))
             {
                 return;
             }
@@ -157,7 +159,7 @@ private static void CheckPostAlertQualityUpdate(ManagementObject obj, HotfixQuer
                 return;
             }
 
-            if (DateTime.TryParse(installedOnStr, out var installedOn) && installedOn > alertCutoff)
+            if (DateTime.TryParse(installedOnStr, CultureInfo.InvariantCulture, DateTimeStyles.None, out var installedOn) && installedOn > alertCutoff)
             {
                 result.MostRecentQualityUpdateDate = installedOn;
             }

PingCastle/misc/WmiHotfixHelper.cs

@@ -188,6 +188,10 @@ public ScanResult Scan(
             {
                 var hotfixResult = RetrieveInstalledHotfixes(computerName, cancellationToken);
                 installedHotfixes = hotfixResult.KbNumbers;
+                if (mostRecentQualityUpdateDate == null)
+                {
+                    mostRecentQualityUpdateDate = hotfixResult.MostRecentQualityUpdateDate;
+                }
             }
 
             return AnalyzeVulnerability(operatingSystem, installedHotfixes, startupTime.Value, mostRecentQualityUpdateDate);
@@ -264,28 +268,7 @@ private ScanResult AnalyzeVulnerability(
                     };
                 }
 
-                bool isCritical = IsCriticalOperatingSystem(operatingSystem);
-                string severity = isCritical ? "Critical" : "Yes";
-                Trace.WriteLine($"[MS14-068] FAIL - Patch not found in installed hotfixes");
-                return new ScanResult
-                {
-                    IsVulnerable = true,
-                    Reason = ReasonPatchNotInstalled,
-                    OsVersion = operatingSystem,
-                    SeverityLevel = severity
-                };
-            }
-
-            if (mostRecentQualityUpdateDate.HasValue && mostRecentQualityUpdateDate.Value > AlertDate)
-            {
-                Trace.WriteLine($"[MS14-068] PASS - Date fallback ({mostRecentQualityUpdateDate.Value:yyyy-MM-dd} > {AlertDate:yyyy-MM-dd})");
-                return new ScanResult
-                {
-                    IsVulnerable = false,
-                    Reason = $"Quality update dated {mostRecentQualityUpdateDate.Value:yyyy-MM-dd} is after MS14-068 release",
-                    OsVersion = operatingSystem,
-                    SeverityLevel = "No"
-                };
+                Trace.WriteLine($"[MS14-068] KB check inconclusive - no matching KB in list");
             }
 
             bool isCriticalFinalCheck = IsCriticalOperatingSystem(operatingSystem);