Making Security Measurable › OVAL › OVAL Developer's Forum

Windows system architecture detection

4 messages

Windows system architecture detection

Reply Threaded

The OVAL scan result for Windows 2003 SP 2, x64 server evaluates oval:org.mitre.oval:def:1870 to be true. This should not be the case as I am running x64 architecture and the definition indicates x32 to be present? Any thoughts?

Thanks,

Prasad N. Shenoy

To unsubscribe, send an email message to [hidden email] with SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have difficulties, write to [hidden email].

Dolinsky, Todd

Re: Windows system architecture detection

Reply Threaded

Some javascript/style in this post has been disabled (why?)

Hi Prasad –

I agree – that’s one of several broken 64-bit inventory definitions that I’ve been tracking. In this case it’s test “oval:org.mitre.oval:tst:2747” that is the issue – it’s looking that the architecture is NOT “ia64”, which is true on either “x86” OR “amd64” systems.

I’m going to be submitting modifications to several inventory definitions in the near future which should hopefully resolve these issues on 64-bit systems.

Todd

From: Prasad Shenoy [mailto:[hidden email]]
Sent: Friday, October 30, 2009 4:35 PM
To: [hidden email]
Subject: [OVAL-DEVELOPER-LIST] Windows system architecture detection

Thanks,

Prasad N. Shenoy

To unsubscribe, send an email message to [hidden email] with SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have difficulties, write to [hidden email].

Prasad Shenoy

Re: Windows system architecture detection

Reply Threaded

In reply to this post by Prasad Shenoy

A follow up: Looking at the definition,the test checks for registry object HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\PROCESSOR_ARCHITECTURE with a state of ia64 to determine a x64 vs x86. The state on my test server is AMD64.

Anyone else have seen this before? Should the test be updated to check for one of the states?

Thanks & Regards,
Prasad N. Shenoy

On Fri, Oct 30, 2009 at 4:35 PM, Prasad Shenoy <[hidden email]> wrote:

The OVAL scan result for Windows 2003 SP 2, x64 server evaluates oval:org.mitre.oval:def:1870 to be true. This should not be the case as I am running x64 architecture and the definition indicates x32 to be present? Any thoughts?

Thanks,

Prasad N. Shenoy

To unsubscribe, send an email message to [hidden email] with SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have difficulties, write to [hidden email].

Maneesh Jolly

Re: Windows system architecture detection

Reply Threaded

Some javascript/style in this post has been disabled (why?)

Hi Prasad,

Regarding the mistake in definition, Todd has already mentioned that it is incorrect. The answer to you query regarding ia64 and amd64 can also be found in Todd’s reply “it’s looking that the architecture is NOT “ia64”, which is true on either “x86” OR “amd64” systems”.

Your system is actually running on AMD64 or x64, which is different from ia64.

X86 = Intel x86 and some other 32-bit processors.

AMD64 = x64 = Intel or AMD 64 bit

IA64 = Intel Itanium based processors.

Refer the definitions oval:org.mitre.oval:tst:3653, oval:org.mitre.oval:tst:3823 and oval:org.mitre.oval:tst:2747 for details.

Thanks,

Maneesh

From: Prasad Shenoy [mailto:[hidden email]]
Sent: Saturday, October 31, 2009 2:18 AM
To: [hidden email]
Subject: Re: [OVAL-DEVELOPER-LIST] Windows system architecture detection

Anyone else have seen this before? Should the test be updated to check for one of the states?

Thanks & Regards,
Prasad N. Shenoy

On Fri, Oct 30, 2009 at 4:35 PM, Prasad Shenoy <[hidden email]> wrote:

Thanks,

Prasad N. Shenoy

To unsubscribe, send an email message to [hidden email] with SIGNOFF OVAL-DEVELOPER-LIST in the BODY of the message. If you have difficulties, write to [hidden email].