New OVAL definition for CVE-2008-1483

2 Messages

Hansen, Nick (HP SW DCA)

Reply Threaded

Please find the attached OVAL definition covering Sun Alert 237444 which address CVE-2008-1483.

Let me know if there are any problems with it.

Thanks,
--Nick

To unsubscribe, send an email message to LISTSERV@... with
SIGNOFF OVAL-DISCUSSION-LIST
in the BODY of the message. If you have difficulties, write to OVAL-DISCUSSION-LIST-request@....

<?xml version="1.0" encoding="UTF-8"?>
<oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oval1="http://oval.mitre.org/XMLSchema/oval-definitions-5" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#windows windows-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#solaris solaris-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#hpux hpux-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#aix aix-definitions-schema.xsd">
<generator>
<oval:product_name>Hewlett-Packard Live Network</oval:product_name>
<oval:schema_version>5.4</oval:schema_version>
<oval:timestamp>2008-08-26T19:27:55.000-00:00</oval:timestamp>
</generator>
<definitions>
<definition id="oval:com.hp.oval:def:8" version="0" class="vulnerability">
<metadata>
<title>Security Vulnerability in Solaris SSH May Allow Unauthorized Access to X11 Sessions</title>
<affected family="unix">
<platform>Sun Solaris 9</platform>
<platform>Sun Solaris 10</platform>
</affected>
<reference source="CVE" ref_id="CVE-2008-1483" ref_url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1483"/>
<description>OpenSSH 4.3p2, and probably other versions, allows local users to hijack forwarded X connections by causing ssh to set DISPLAY to :10, even when another process is listening on the associated port, as demonstrated by opening TCP port 6010 (IPv4) and sniffing a cookie sent by Emacs.</description>
<oval_repository>
<dates>
<submitted date="2008-08-25T11:33:40.000-04:00">
<contributor organization="Hewlett-Packard">Nicholas Hansen</contributor>
</submitted>
</dates>
<status>DRAFT</status>
</oval_repository>
</metadata>
<criteria operator="AND">
<criteria operator="OR" comment="Software Section">
<criteria operator="AND" comment="Solaris 9 (SPARC) meets Sun Alert 237444" negate="false">
<extend_definition comment="Solaris 9 (SPARC) is installed" definition_ref="oval:org.mitre.oval:def:1457"/>
<criterion comment="Patch 114356-14 or later installed" test_ref="oval:com.hp.oval:tst:17" negate="true"/>
<criterion comment="X11Forwarding is enabled" negate="false" test_ref="oval:com.hp.oval:tst:21"/>
</criteria>
<criteria operator="AND" comment="Solaris 9 (x86) meets Sun Alert 237444" negate="false">
<extend_definition comment="Solaris 9 (x86) is installed" definition_ref="oval:org.mitre.oval:def:1683"/>
<criterion comment="Patch 114357-13 or later installed" test_ref="oval:com.hp.oval:tst:18" negate="true"/>
<criterion comment="X11Forwarding is enabled" negate="false" test_ref="oval:com.hp.oval:tst:21"/>
</criteria>
<criteria operator="AND" comment="Solaris 10 (SPARC) meets Sun Alert 237444" negate="false">
<extend_definition comment="Solaris 10 (SPARC) is installed" definition_ref="oval:org.mitre.oval:def:1440"/>
<criterion comment="Patch 126133-03 or later installed" test_ref="oval:com.hp.oval:tst:19" negate="true"/>
<criterion comment="X11Forwarding is not enabled" negate="true" test_ref="oval:com.hp.oval:tst:22"/>
</criteria>
<criteria operator="AND" comment="Solaris 10 (x86) meets Sun Alert 237444" negate="false">
<extend_definition comment="Solaris 10 (x86) is installed" definition_ref="oval:org.mitre.oval:def:1926"/>
<criterion comment="Patch 126134-03 or later installed" test_ref="oval:com.hp.oval:tst:20" negate="true"/>
<criterion comment="X11Forwarding is not enabled" negate="true" test_ref="oval:com.hp.oval:tst:22"/>
</criteria>
</criteria>
<criteria comment="Configuration Section">
<criterion comment="sshd running" negate="false" test_ref="oval:org.mitre.oval:tst:484"/>
</criteria>
</criteria>
</definition>
<definition id="oval:org.mitre.oval:def:1440" version="1" class="inventory">
<metadata>
<title>Solaris 10 (SPARC) is installed</title>
<affected family="unix">
<platform>Sun Solaris 10</platform>
</affected>
<reference source="CPE" ref_id="cpe:/o:sun:sunos:5.10::sparc"/>
<description>The operating system installed on the system is Sun Solaris 10 for SPARC.</description>
<oval_repository>
<dates>
<submitted date="2007-06-15T12:00:00.000-04:00">
<contributor organization="The MITRE Corporation">Jonathan Baker</contributor>
</submitted>
<status_change date="2007-06-15T12:20:00.000-04:00">DRAFT</status_change>
<status_change date="2007-07-03T21:53:52.343-04:00">INTERIM</status_change>
<status_change date="2007-07-18T15:57:49.640-04:00">ACCEPTED</status_change>
</dates>
<status>ACCEPTED</status>
</oval_repository>
</metadata>
<criteria>
<criterion comment="Solaris 10 Installed" test_ref="oval:org.mitre.oval:tst:3680"/>
<criterion comment="sparc architecture" test_ref="oval:org.mitre.oval:tst:3237"/>
</criteria>
</definition>
<definition id="oval:org.mitre.oval:def:1457" version="1" class="inventory">
<metadata>
<title>Solaris 9 (SPARC) is installed</title>
<affected family="unix">
<platform>Sun Solaris 9</platform>
</affected>
<reference source="CPE" ref_id="cpe:/o:sun:sunos:5.9::sparc"/>
<description>The operating system installed on the system is Sun Solaris 9 for SPARC.</description>
<oval_repository>
<dates>
<submitted date="2007-06-22T08:00:00.000-04:00">
<contributor organization="The MITRE Corporation">Jonathan Baker</contributor>
</submitted>
<status_change date="2007-06-22T08:20:00.000-04:00">DRAFT</status_change>
<status_change date="2007-07-10T21:08:48.350-04:00">INTERIM</status_change>
<status_change date="2007-08-01T22:26:14.151-04:00">ACCEPTED</status_change>
</dates>
<status>ACCEPTED</status>
</oval_repository>
</metadata>
<criteria>
<criterion comment="Solaris 9 Installed" test_ref="oval:org.mitre.oval:tst:3172"/>
<criterion comment="sparc architecture" test_ref="oval:org.mitre.oval:tst:3237"/>
</criteria>
</definition>
<definition id="oval:org.mitre.oval:def:1683" version="1" class="inventory">
<metadata>
<title>Solaris 9 (x86) is installed</title>
<affected family="unix">
<platform>Sun Solaris 9</platform>
</affected>
<reference source="CPE" ref_id="cpe:/o:sun:sunos:5.9::ix86"/>
<description>The operating system installed on the system is Sun Solaris 9 for x86.</description>
<oval_repository>
<dates>
<submitted date="2007-06-22T08:00:00.000-04:00">
<contributor organization="The MITRE Corporation">Jonathan Baker</contributor>
</submitted>
<status_change date="2007-06-22T08:20:00.000-04:00">DRAFT</status_change>
<status_change date="2007-07-10T21:08:49.960-04:00">INTERIM</status_change>
<status_change date="2007-08-01T22:26:14.277-04:00">ACCEPTED</status_change>
</dates>
<status>ACCEPTED</status>
</oval_repository>
</metadata>
<criteria>
<criterion comment="Solaris 9 Installed" test_ref="oval:org.mitre.oval:tst:3172"/>
<criterion comment="ix86 architecture" test_ref="oval:org.mitre.oval:tst:3912"/>
</criteria>
</definition>
<definition id="oval:org.mitre.oval:def:1926" version="1" class="inventory">
<metadata>
<title>Solaris 10 (x86) is installed</title>
<affected family="unix">
<platform>Sun Solaris 10</platform>
</affected>
<reference source="CPE" ref_id="cpe:/o:sun:sunos:5.10::ix86"/>
<description>The operating system installed on the system is Sun Solaris 10 for x86.</description>
<oval_repository>
<dates>
<submitted date="2007-06-15T12:00:00.000-04:00">
<contributor organization="The MITRE Corporation">Jonathan Baker</contributor>
</submitted>
<status_change date="2007-06-15T12:20:00.000-04:00">DRAFT</status_change>
<status_change date="2007-07-03T21:53:53.007-04:00">INTERIM</status_change>
<status_change date="2007-07-18T15:57:51.357-04:00">ACCEPTED</status_change>
</dates>
<status>ACCEPTED</status>
</oval_repository>
</metadata>
<criteria>
<criterion comment="Solaris 10 Installed" test_ref="oval:org.mitre.oval:tst:3680"/>
<criterion comment="ix86 architecture" test_ref="oval:org.mitre.oval:tst:3912"/>
</criteria>
</definition>
</definitions>
<tests>
<patch_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#solaris" check_existence="at_least_one_exists" comment="Patch 114356-14 or later installed" check="at least one" version="1" id="oval:com.hp.oval:tst:17">
<object object_ref="oval:com.hp.oval:obj:16"/>
<state state_ref="oval:com.hp.oval:ste:10"/>
</patch_test>
<patch_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#solaris" check_existence="at_least_one_exists" comment="Patch 114357-13 or later installed" check="at least one" version="1" id="oval:com.hp.oval:tst:18">
<object object_ref="oval:com.hp.oval:obj:17"/>
<state state_ref="oval:com.hp.oval:ste:11"/>
</patch_test>
<patch_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#solaris" check_existence="at_least_one_exists" comment="Patch 126133-03 or later installed" check="at least one" version="1" id="oval:com.hp.oval:tst:19">
<object object_ref="oval:com.hp.oval:obj:18"/>
<state state_ref="oval:com.hp.oval:ste:12"/>
</patch_test>
<patch_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#solaris" check_existence="at_least_one_exists" comment="Patch 126134-03 or later installed" check="at least one" version="1" id="oval:com.hp.oval:tst:20">
<object object_ref="oval:com.hp.oval:obj:19"/>
<state state_ref="oval:com.hp.oval:ste:12"/>
</patch_test>
<textfilecontent_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:com.hp.oval:tst:21" version="1" check="at least one" comment="X11Forwarding is enabled" check_existence="at_least_one_exists">
<object object_ref="oval:com.hp.oval:obj:20"/>
</textfilecontent_test>
<textfilecontent_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:com.hp.oval:tst:22" version="1" check="at least one" comment="X11Forwarding is not enabled" check_existence="at_least_one_exists">
<object object_ref="oval:com.hp.oval:obj:21"/>
</textfilecontent_test>
<process_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:org.mitre.oval:tst:484" version="1" check="all" comment="sshd running" check_existence="at_least_one_exists">
<object object_ref="oval:org.mitre.oval:obj:415"/>
</process_test>
<uname_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:org.mitre.oval:tst:3172" version="1" comment="Solaris 9 Installed" check_existence="at_least_one_exists" check="at least one">
<object object_ref="oval:org.mitre.oval:obj:2759"/>
<state state_ref="oval:org.mitre.oval:ste:3891"/>
</uname_test>
<uname_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:org.mitre.oval:tst:3237" version="1" comment="sparc architecture" check_existence="at_least_one_exists" check="at least one">
<object object_ref="oval:org.mitre.oval:obj:2759"/>
<state state_ref="oval:org.mitre.oval:ste:3478"/>
</uname_test>
<uname_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:org.mitre.oval:tst:3680" version="1" comment="Solaris 10 Installed" check_existence="at_least_one_exists" check="at least one">
<object object_ref="oval:org.mitre.oval:obj:2759"/>
<state state_ref="oval:org.mitre.oval:ste:3597"/>
</uname_test>
<uname_test xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:org.mitre.oval:tst:3912" version="1" comment="ix86 architecture" check_existence="at_least_one_exists" check="at least one">
<object object_ref="oval:org.mitre.oval:obj:2759"/>
<state state_ref="oval:org.mitre.oval:ste:3443"/>
</uname_test>
</tests>
<objects>
<patch_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#solaris" version="1" id="oval:com.hp.oval:obj:16">
<base datatype="int">114356</base>
</patch_object>
<patch_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#solaris" version="1" id="oval:com.hp.oval:obj:17">
<base datatype="int">114357</base>
</patch_object>
<patch_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#solaris" version="1" id="oval:com.hp.oval:obj:18">
<base datatype="int">126133</base>
</patch_object>
<patch_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#solaris" version="1" id="oval:com.hp.oval:obj:19">
<base datatype="int">126134</base>
</patch_object>
<textfilecontent_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:com.hp.oval:obj:20" version="1">
<path>/etc/ssh</path>
<filename>sshd_config</filename>
<line operation="pattern match">^\s*X11Forwarding\s+yes\s*</line>
</textfilecontent_object>
<textfilecontent_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" id="oval:com.hp.oval:obj:21" version="1">
<path>/etc/ssh</path>
<filename>sshd_config</filename>
<line operation="pattern match">^\s*X11Forwarding\s+no\s*</line>
</textfilecontent_object>
<process_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:org.mitre.oval:obj:415" version="1">
<command operation="pattern match" datatype="string">^.*sshd.*</command>
</process_object>
<uname_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:org.mitre.oval:obj:2759" version="1" comment="The single uname object."/>
</objects>
<states>
<patch_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#solaris" operator="AND" version="1" id="oval:com.hp.oval:ste:10">
<version operation="greater than or equal" datatype="int">14</version>
</patch_state>
<patch_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#solaris" operator="AND" version="1" id="oval:com.hp.oval:ste:11">
<version operation="greater than or equal" datatype="int">13</version>
</patch_state>
<patch_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#solaris" operator="AND" version="1" id="oval:com.hp.oval:ste:12">
<version operation="greater than or equal" datatype="int">03</version>
</patch_state>
<uname_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:org.mitre.oval:ste:3443" version="1" comment="processor type is ix86">
<processor_type operation="pattern match">^i.*86</processor_type>
</uname_state>
<uname_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:org.mitre.oval:ste:3478" version="1" comment="processor type is SPARC">
<processor_type operation="pattern match">[Ss][Pp][Aa][Rr][Cc]</processor_type>
</uname_state>
<uname_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:org.mitre.oval:ste:3597" version="1">
<os_release>5.10</os_release>
</uname_state>
<uname_state xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" id="oval:org.mitre.oval:ste:3891" version="1" comment="os release is 5.9">
<os_release>5.9</os_release>
</uname_state>
</states>
</oval_definitions>

Worrell, Bryan A.

Re: New OVAL definition for CVE-2008-1483

Reply Threaded

Nick,

Thank you for your submission to the OVAL Repository. Your submission
has been processed and is available for further community review via
the OVAL Repository website.

Thanks,
Bryan Worrell

__
Bryan Worrell
The MITRE Corporation
bworrell@...

>-----Original Message-----
>From: Hansen, Nick [mailto:nick.hansen@...]
>Sent: Wednesday, August 27, 2008 11:45 AM
>To: oval-discussion-list OVAL Discussion List/Closed Public Discussi
>Subject: [OVAL-DISCUSSION-LIST] New OVAL definition for CVE-2008-1483
>
>Please find the attached OVAL definition covering Sun Alert 237444
which

>address CVE-2008-1483.
>
>Let me know if there are any problems with it.
>
>Thanks,
>--Nick
>
>
>
>To unsubscribe, send an email message to LISTSERV@... with
>SIGNOFF OVAL-DISCUSSION-LIST
>in the BODY of the message. If you have difficulties, write to OVAL-
>DISCUSSION-LIST-request@....

To unsubscribe, send an email message to LISTSERV@... with
SIGNOFF OVAL-DISCUSSION-LIST
in the BODY of the message. If you have difficulties, write to OVAL-DISCUSSION-LIST-request@....