{"action":"closed","issue":{"url":"https://api.github.com/repos/wazuh/wazuh-qa/issues/163","repository_url":"https://api.github.com/repos/wazuh/wazuh-qa","labels_url":"https://api.github.com/repos/wazuh/wazuh-qa/issues/163/labels{/name}","comments_url":"https://api.github.com/repos/wazuh/wazuh-qa/issues/163/comments","events_url":"https://api.github.com/repos/wazuh/wazuh-qa/issues/163/events","html_url":"https://github.com/wazuh/wazuh-qa/issues/163","id":501383227,"node_id":"MDU6SXNzdWU1MDEzODMyMjc=","number":163,"title":"Test Vulnerability detector Windows","user":{"login":"chemamartinez","id":29475387,"node_id":"MDQ6VXNlcjI5NDc1Mzg3","avatar_url":"https://avatars1.githubusercontent.com/u/29475387?v=4","gravatar_id":"","url":"https://api.github.com/users/chemamartinez","html_url":"https://github.com/chemamartinez","followers_url":"https://api.github.com/users/chemamartinez/followers","following_url":"https://api.github.com/users/chemamartinez/following{/other_user}","gists_url":"https://api.github.com/users/chemamartinez/gists{/gist_id}","starred_url":"https://api.github.com/users/chemamartinez/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chemamartinez/subscriptions","organizations_url":"https://api.github.com/users/chemamartinez/orgs","repos_url":"https://api.github.com/users/chemamartinez/repos","events_url":"https://api.github.com/users/chemamartinez/events{/privacy}","received_events_url":"https://api.github.com/users/chemamartinez/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"SalvaMilenario","id":11089105,"node_id":"MDQ6VXNlcjExMDg5MTA1","avatar_url":"https://avatars0.githubusercontent.com/u/11089105?v=4","gravatar_id":"","url":"https://api.github.com/users/SalvaMilenario","html_url":"https://github.com/SalvaMilenario","followers_url":"https://api.github.com/users/SalvaMilenario/followers","following_url":"https://api.github.com/users/SalvaMilenario/following{/other_user}","gists_url":"https://api.github.com/users/SalvaMilenario/gists{/gist_id}","starred_url":"https://api.github.com/users/SalvaMilenario/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SalvaMilenario/subscriptions","organizations_url":"https://api.github.com/users/SalvaMilenario/orgs","repos_url":"https://api.github.com/users/SalvaMilenario/repos","events_url":"https://api.github.com/users/SalvaMilenario/events{/privacy}","received_events_url":"https://api.github.com/users/SalvaMilenario/received_events","type":"User","site_admin":false},"assignees":[{"login":"SalvaMilenario","id":11089105,"node_id":"MDQ6VXNlcjExMDg5MTA1","avatar_url":"https://avatars0.githubusercontent.com/u/11089105?v=4","gravatar_id":"","url":"https://api.github.com/users/SalvaMilenario","html_url":"https://github.com/SalvaMilenario","followers_url":"https://api.github.com/users/SalvaMilenario/followers","following_url":"https://api.github.com/users/SalvaMilenario/following{/other_user}","gists_url":"https://api.github.com/users/SalvaMilenario/gists{/gist_id}","starred_url":"https://api.github.com/users/SalvaMilenario/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SalvaMilenario/subscriptions","organizations_url":"https://api.github.com/users/SalvaMilenario/orgs","repos_url":"https://api.github.com/users/SalvaMilenario/repos","events_url":"https://api.github.com/users/SalvaMilenario/events{/privacy}","received_events_url":"https://api.github.com/users/SalvaMilenario/received_events","type":"User","site_admin":false},{"login":"JcabreraC","id":39765143,"node_id":"MDQ6VXNlcjM5NzY1MTQz","avatar_url":"https://avatars0.githubusercontent.com/u/39765143?v=4","gravatar_id":"","url":"https://api.github.com/users/JcabreraC","html_url":"https://github.com/JcabreraC","followers_url":"https://api.github.com/users/JcabreraC/followers","following_url":"https://api.github.com/users/JcabreraC/following{/other_user}","gists_url":"https://api.github.com/users/JcabreraC/gists{/gist_id}","starred_url":"https://api.github.com/users/JcabreraC/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JcabreraC/subscriptions","organizations_url":"https://api.github.com/users/JcabreraC/orgs","repos_url":"https://api.github.com/users/JcabreraC/repos","events_url":"https://api.github.com/users/JcabreraC/events{/privacy}","received_events_url":"https://api.github.com/users/JcabreraC/received_events","type":"User","site_admin":false}],"milestone":null,"comments":13,"created_at":"2019-10-02T09:39:40Z","updated_at":"2019-11-11T08:48:12Z","closed_at":"2019-11-11T08:48:12Z","author_association":"MEMBER","body":"# Vulnerability detector\r\n\r\n| Version | Revision | Branch |\r\n| --- | --- | --- | \r\n| 3.11.0 | 31100 | [vuln-windows](https://github.com/wazuh/wazuh/tree/vuln-windows) |\r\n\r\n## Summary\r\n- [x] VUL001\r\n- [x] VUL002\r\n- [x] VUL003\r\n- [x] VUL004\r\n- [x] VUL005\r\n- [x] VUL006\r\n- [x] VUL007\r\n- [x] VUL008\r\n- [x] VUL009\r\n- [x] VUL010\r\n- [x] VUL011\r\n- [x] VUL012\r\n- [x] VUL013\r\n- [x] VUL014\r\n- [x] VUL015\r\n\r\n\r\n## VUL001\r\n\r\n**Short description**\r\n\r\nVulnerability-detector must update the local DBs with the latest feeds.\r\n\r\n**Category**\r\n\r\nVulnerability-detector\r\n\r\n**Subcategory**\r\n\r\nDatabase updates\r\n\r\n**Description**\r\n\r\nVulnerability-detector needs to update the DB each `frequency` time, it is required to check in the logs if the downloads are working properly.\r\n\r\n**Configuration sample**\r\n\r\n``` XML\r\n  <vulnerability-detector>\r\n    <enabled>yes</enabled>\r\n    <interval>100d</interval>\r\n    <run_on_start>yes</run_on_start>\r\n    <provider name=\"canonical\">\r\n      <enabled>yes</enabled>\r\n      <os update_interval=\"10m\">precise</os>\r\n      <os update_interval=\"20m\">trusty</os>\r\n      <os update_interval=\"30m\">xenial</os>\r\n      <os>bionic</os>\r\n      <update_interval>40m</update_interval>\r\n    </provider>\r\n    <provider name=\"debian\">\r\n      <enabled>yes</enabled>\r\n      <os>wheezy</os>\r\n      <os>stretch</os>\r\n      <os>jessie</os>\r\n      <update_interval>30m</update_interval>\r\n    </provider>\r\n    <provider name=\"redhat\">\r\n      <enabled>yes</enabled>\r\n      <update_from_year>2015</update_from_year>\r\n      <update_interval>10m</update_interval>\r\n    </provider>\r\n    <provider name=\"nvd\">\r\n      <enabled>yes</enabled>\r\n      <update_from_year>2015</update_from_year>\r\n      <update_interval>15m</update_interval>\r\n    </provider>\r\n  </vulnerability-detector>\r\n```\r\n\r\n**Min/Max compatible versions**\r\n3.11.0 - Current\r\n\r\n**Expected logs**\r\n\r\nWe should see a `5461` message approximately every individual interval is reached. If you apply the previous configuration:\r\n\r\n- **Ubuntu Precise** every 10 minutes.\r\n- **Ubuntu Trusty** every 20 minutes.\r\n- **Ubuntu Xenial** every 30 minutes.\r\n- **Ubuntu Bionic** every 40 minutes.\r\n- **Debian Wheezy** every 30 minutes.\r\n- **Debian Stretch** every 30 minutes.\r\n- **Debian Jessie** every 30 minutes.\r\n- **Red Hat** every 10 minutes.\r\n- **National Vulnerability Database** every 15 minutes.\r\n\r\n> 2019/09/25 11:31:56 wazuh-modulesd:vulnerability-detector: INFO: (5461): Starting Ubuntu Bionic database update.\r\n> 2019/09/25 11:32:03 wazuh-modulesd:vulnerability-detector: INFO: (5494): The update of the Ubuntu Bionic feed finished successfully.\r\n> 2019/09/25 11:32:03 wazuh-modulesd:vulnerability-detector: INFO: (5461): Starting Ubuntu Xenial database update.\r\n> 2019/09/25 11:32:14 wazuh-modulesd:vulnerability-detector: INFO: (5494): The update of the Ubuntu Xenial feed finished successfully.\r\n> 2019/09/25 11:32:14 wazuh-modulesd:vulnerability-detector: INFO: (5461): Starting Ubuntu Trusty database update.\r\n> 2019/09/25 11:32:26 wazuh-modulesd:vulnerability-detector: INFO: (5494): The update of the Ubuntu Trusty feed finished successfully.\r\n> 2019/09/25 11:32:26 wazuh-modulesd:vulnerability-detector: INFO: (5461): Starting Ubuntu Precise database update.\r\n> 2019/09/25 11:32:42 wazuh-modulesd:vulnerability-detector: INFO: (5494): The update of the Ubuntu Precise feed finished successfully.\r\n> 2019/09/25 11:32:42 wazuh-modulesd:vulnerability-detector: INFO: (5461): Starting Debian Stretch database update.\r\n> 2019/09/25 11:32:51 wazuh-modulesd:vulnerability-detector: INFO: (5494): The update of the Debian Stretch feed finished successfully.\r\n> 2019/09/25 11:32:51 wazuh-modulesd:vulnerability-detector: INFO: (5461): Starting Debian Jessie database update.\r\n> 2019/09/25 11:32:59 wazuh-modulesd:vulnerability-detector: INFO: (5494): The update of the Debian Jessie feed finished successfully.\r\n> 2019/09/25 11:32:59 wazuh-modulesd:vulnerability-detector: INFO: (5461): Starting Debian Wheezy database update.\r\n> 2019/09/25 11:33:00 wazuh-modulesd:vulnerability-detector: INFO: (5494): The update of the Debian Wheezy feed finished successfully.\r\n> 2019/09/25 11:33:00 wazuh-modulesd:vulnerability-detector: INFO: (5461): Starting Red Hat Enterprise Linux database update.\r\n> 2019/09/25 11:33:15 wazuh-modulesd:vulnerability-detector: INFO: (5494): The update of the Red Hat Enterprise Linux feed finished successfully.\r\n> 2019/09/25 11:33:16 wazuh-modulesd:vulnerability-detector: INFO: (5461): Starting National Vulnerability Database database update.\r\n> 2019/09/25 11:34:43 wazuh-modulesd:vulnerability-detector: INFO: (5494): The update of the National Vulnerability Database feed finished successfully.\r\n\r\n\r\n## VUL002\r\n\r\n**Short description**\r\n\r\nVulnerability-detector must accept the deprecated `<disabled>` option.\r\n\r\n**Category**\r\n\r\nVulnerability-detector\r\n\r\n**Subcategory**\r\n\r\nRetro compatibility\r\n\r\n**Description**\r\n\r\nThis option `<disabled>` has been in favour of `<enabled>`, but it should work during several versions and warn that it is deprecated.\r\n\r\n**Configuration sample**\r\n\r\n``` XML\r\n  <vulnerability-detector>\r\n    <disabled>no</disabled>\r\n  </vulnerability-detector>\r\n```\r\n\r\n**Min/Max compatible versions**\r\n3.11.0 - 4.0.0\r\n\r\n**Expected logs**\r\n\r\n> 2019/09/25 12:35:21 wazuh-modulesd: WARNING: 'disabled' option at module 'vulnerability-detector' is deprecated. Use 'enabled' instead.\r\n> 2019/09/25 12:35:22 wazuh-modulesd:vulnerability-detector: INFO: (5452): Starting vulnerability scanning.\r\n\r\n\r\n## VUL003\r\n\r\n**Short description**\r\n\r\nVulnerability-detector must not update the feeds if they are updated.\r\n\r\n**Category**\r\n\r\nVulnerability-detector\r\n\r\n**Subcategory**\r\n\r\nDatabase updates\r\n\r\n**Description**\r\n\r\nVulnerability-detector is able to check if a vulnerability feed is outdated or not, to update it if it is necessary. The tests consist on to verify that the feeds are not being updated if the remote database has not changed. We will observe different behaviour depending on what feed is updating.\r\n\r\n- For **Canonical** and **Debian** feeds, Vulnerability Detector will download the entire OVAL file, but it won't try to index it if that version has already been updated.\r\n- For the **National Vulnerability Database** feed, Vulnerability Detector will download lightweight metadata files that will be used to evaluate if the database (heavier file) must be fetched too. This is checked for each file, as this feed divides the vulnerabilities into annual files which can be updated at different times.\r\n- The **Red Hat** feed doest not follow this rule because we have not a way to verify if that feed has been updated since last time we indexed it.\r\n\r\n**Configuration sample**\r\n\r\n``` XML\r\n  <vulnerability-detector>\r\n    <enabled>yes</enabled>\r\n    <interval>100d</interval>\r\n    <run_on_start>yes</run_on_start>\r\n    <provider name=\"canonical\">\r\n      <enabled>yes</enabled>\r\n      <os update_interval=\"1m\">precise</os>\r\n      <os update_interval=\"1m\">trusty</os>\r\n      <os update_interval=\"1m\">xenial</os>\r\n      <os>bionic</os>\r\n      <update_interval>1m</update_interval>\r\n    </provider>\r\n    <provider name=\"debian\">\r\n      <enabled>yes</enabled>\r\n      <os>wheezy</os>\r\n      <os>stretch</os>\r\n      <os>jessie</os>\r\n      <update_interval>1m</update_interval>\r\n    </provider>\r\n    <provider name=\"nvd\">\r\n      <enabled>yes</enabled>\r\n      <update_from_year>2015</update_from_year>\r\n      <update_interval>1m</update_interval>\r\n    </provider>\r\n  </vulnerability-detector>\r\n```\r\n\r\n**Min/Max compatible versions**\r\n3.11.0 - Current\r\n\r\n**Expected logs**\r\n\r\nTo view those logs you need to enable the level 2 debug in modulesd.\r\n\r\n> 2019/09/25 13:43:10 wazuh-modulesd:vulnerability-detector[4618] wm_vuln_detector.c:2256 at wm_vuldet_fetch_oval(): DEBUG: (5457): Ubuntu Bionic OVAL is in its latest version. Update date: 2019-09-25T12:43:19\r\n> 2019/09/25 13:43:15 wazuh-modulesd:vulnerability-detector[4618] wm_vuln_detector.c:2256 at wm_vuldet_fetch_oval(): DEBUG: (5457): Ubuntu Xenial OVAL is in its latest version. Update date: 2019-09-25T12:43:19\r\n> 2019/09/25 13:43:27 wazuh-modulesd:vulnerability-detector[4618] wm_vuln_detector.c:2256 at wm_vuldet_fetch_oval(): DEBUG: (5457): Ubuntu Trusty OVAL is in its latest version. Update date: 2019-04-26T13:07:52\r\n> 2019/09/25 13:43:50 wazuh-modulesd:vulnerability-detector[4618] wm_vuln_detector.c:2256 at wm_vuldet_fetch_oval(): DEBUG: (5457): Ubuntu Precise OVAL is in its latest version. Update date: 2017-05-10T19:31:06\r\n> 2019/09/25 13:43:51 wazuh-modulesd:vulnerability-detector[4618] wm_vuln_detector.c:2256 at wm_vuldet_fetch_oval(): DEBUG: (5457): Debian Stretch OVAL is in its latest version. Update date: 2019-09-25T11:30:20.188-04:00\r\n> 2019/09/25 13:43:53 wazuh-modulesd:vulnerability-detector[4618] wm_vuln_detector.c:2256 at wm_vuldet_fetch_oval(): DEBUG: (5457): Debian Jessie OVAL is in its latest version. Update date: 2019-09-25T11:30:08.188-04:00\r\n> 2019/09/25 13:43:54 wazuh-modulesd:vulnerability-detector[4618] wm_vuln_detector.c:2256 at wm_vuldet_fetch_oval(): DEBUG: (5457): Debian Wheezy OVAL is in its latest version. Update date: 2019-09-25T11:30:02.188-04:00\r\n> 2019/09/25 13:43:54 wazuh-modulesd:vulnerability-detector[4618] wm_vuln_detector.c:3738 at wm_vuldet_fetch_wazuh_cpe(): DEBUG: (5457): Wazuh CPE dictionary OVAL is in its latest version. Update date: 2019-07-05T00:33Z\r\n\r\n\r\n## VUL004\r\n\r\n**Short description**\r\n\r\nVulnerability-detector must download the feeds from the year indicated by `<update_from_year>`.\r\n\r\n**Category**\r\n\r\nVulnerability-detector\r\n\r\n**Subcategory**\r\n\r\nDatabase updates\r\n\r\n**Description**\r\n\r\nThis option is only valid for the Red Hat and National Vulnerability feeds. To verify that all is working as expected, you can filter\r\n\r\n**Configuration sample**\r\n\r\n``` XML\r\n  <vulnerability-detector>\r\n    <enabled>yes</enabled>\r\n    <interval>100d</interval>\r\n    <run_on_start>yes</run_on_start>\r\n    <provider name=\"redhat\">\r\n      <enabled>yes</enabled>\r\n      <update_from_year>2015</update_from_year>\r\n      <update_interval>1m</update_interval>\r\n    </provider>\r\n    <provider name=\"nvd\">\r\n      <enabled>yes</enabled>\r\n      <update_from_year>2013</update_from_year>\r\n      <update_interval>1m</update_interval>\r\n    </provider>\r\n  </vulnerability-detector>\r\n```\r\n\r\n**Min/Max compatible versions**\r\n3.11.0 - Current\r\n\r\n**Expected logs**\r\n\r\nIf you are using the previous configuration, for the National Vulnerability Database feed you should see the following logs:\r\n\r\n> 2019/09/25 13:43:55 wazuh-modulesd:vulnerability-detector[4618] wm_vuln_detector.c:1124 at wm_vuldet_update_feed(): DEBUG: (5512): Synchronizing the year 2015 of the vulnerability database.\r\n> 2019/09/25 13:43:56 wazuh-modulesd:vulnerability-detector[4618] wm_vuln_detector.c:1124 at wm_vuldet_update_feed(): DEBUG: (5512): Synchronizing the year 2016 of the vulnerability database.\r\n> 2019/09/25 13:43:57 wazuh-modulesd:vulnerability-detector[4618] wm_vuln_detector.c:1124 at wm_vuldet_update_feed(): DEBUG: (5512): Synchronizing the year 2017 of the vulnerability database.\r\n> 2019/09/25 13:43:57 wazuh-modulesd:vulnerability-detector[4618] wm_vuln_detector.c:1124 at wm_vuldet_update_feed(): DEBUG: (5512): Synchronizing the year 2018 of the vulnerability database.\r\n> 2019/09/25 13:43:58 wazuh-modulesd:vulnerability-detector[4618] wm_vuln_detector.c:1124 at wm_vuldet_update_feed(): DEBUG: (5512): Synchronizing the year 2019 of the vulnerability database.\r\n\r\nThe Red Hat update can be verified by seeing the API call. In the following log, we can see that the requests start in 2013 (according to the configuration):\r\n\r\n> 2019/09/25 13:47:16 wazuh-modulesd:vulnerability-detector[4665] wm_vuln_detector.c:2294 at wm_vuldet_fetch_redhat(): DEBUG: (5554): Trying to download 'https://access.redhat.com/labs/securitydataapi/cve.json?after=2015-01-01&per_page=1000&page=1'.\r\n\r\nThose logs will only be displayed if you enable the level 1 debug for modulesd.\r\n\r\n\r\n## VUL005\r\n\r\n**Short description**\r\n\r\nThe package comparations must have sense.\r\n\r\n**Category**\r\n\r\nVulnerability-detector\r\n\r\n**Subcategory**\r\n\r\nVulnerability detection\r\n\r\n**Description**\r\n\r\nTo evaluate if a package is vulnerable or not, the module performs a comparison between its version and the version where the vulnerability was fixed/disappeared. These checks are displayed en the `ossec.log` file if debug level of modulesd is level 2.\r\n\r\nYou can verify that the result of those checks is correct by checking the messages whose ID is 5467, 5468, 5533 or 5456.\r\n\r\nIf this test were automatized, we could use an external library or module to parse these messages and evaluate if the comparison results in a false positive, negative or it is correct.\r\n\r\n**Configuration sample**\r\n\r\nTest results will be more accurate the more systems the configuration covers and the more agents supported are connected.\r\n\r\n**Min/Max compatible versions**\r\n3.11.0 - Current\r\n\r\n**Expected logs**\r\n\r\nLogs depend on the agents being analysed, and whether or not they are vulnerable. Examples:\r\n\r\n> 2019/09/25 14:44:57 wazuh-modulesd:vulnerability-detector[5541] wm_vuln_detector_nvd.c:2624 at wm_vuldet_check_hotfix(): DEBUG: (5533): Agent 1 is vulnerable to CVE-2017-0076 because does not have the '4012212' patch installed.\r\n> 2019/09/25 14:45:04 wazuh-modulesd:vulnerability-detector[5541] wm_vuln_detector.c:931 at wm_vuldet_report_agent_vulnerabilities(): DEBUG: (5456): The 'libmpfr4' package from agent 0 is not vulnerable to CVE-2014-9474. Condition: package version (3.1.4-1) less than 3.1.2-2.\r\n\r\n\r\n## VUL006\r\n\r\n**Short description**\r\n\r\nThe vulnerability database must be removed between updates.\r\n\r\n**Category**\r\n\r\nVulnerability-detector\r\n\r\n**Subcategory**\r\n\r\nFile integrity\r\n\r\n**Description**\r\n\r\nThe information stored in `<installation_path>/queue/vulnerability/cve.db` is not currently persistent, so the database must be removed between updates.\r\n\r\nTo verify it, perform a vulnerability scan or update, check that the database exists, modify the `ossec.conf` file to disable the module, and update Wazuh. After this, the database should not exist.\r\n\r\nImplicated code:\r\n- [RPM SPECS](https://github.com/wazuh/wazuh-packages/blob/48abb535e609d608fec1be6104391794664a7a07/rpms/SPECS/3.11.0/wazuh-manager-3.11.0.spec#L213).\r\n- [DEB postinstall](https://github.com/wazuh/wazuh-packages/blob/549915e2f720d0a5f58f60e6586fdf83ccf845c4/debs/SPECS/3.10.0/wazuh-manager/debian/postinst#L114).\r\n\r\n**Configuration sample**\r\n\r\nDoesn't matter.\r\n\r\n**Min/Max compatible versions**\r\n3.11.0 - Current\r\n\r\n**Expected logs**\r\n\r\nPackage installation logs, but we don't need to check them for the test.\r\n\r\n\r\n## VUL007\r\n\r\n**Short description**\r\n\r\nThere does not have to be duplicated alerts.\r\n\r\n**Category**\r\n\r\nVulnerability-detector\r\n\r\n**Subcategory**\r\n\r\nVulnerability Detection\r\n\r\n**Description**\r\n\r\nThis test consists in check that there are no duplicated alerts. We consider a report duplicated where we found two or more alerts with the same value in the following fields:\r\n\r\n``` JSON\r\nagents.id\r\ndata.vulnerability.cve\r\ndata.vulnerability.software.name\r\ndata.vulnerability.software.version\r\ndata.vulnerability.software.architecture\r\ndata.vulnerability.software.generated_cpe\r\n```\r\n\r\nPlease note that some of the fields mentioned above may not appear.\r\n\r\n**Configuration sample**\r\n\r\nTest results will be more accurate the more systems the configuration covers and the more agents supported are connected.\r\n\r\n**Min/Max compatible versions**\r\n3.11.0 - Current\r\n\r\n**Expected logs**\r\n\r\nThis test must be performed by checking the `alerts.json` file.\r\n\r\n\r\n## VUL008\r\n\r\n**Short description**\r\n\r\nVulnerability-detector must be able to perform an offline update.\r\n\r\n**Category**\r\n\r\nVulnerability-detector\r\n\r\n**Subcategory**\r\n\r\nDatabase updates\r\n\r\n**Description**\r\n\r\nWe understand offline update as the one in which we indicate an alternative repository where getting the vulnerability database.\r\n\r\nThis type of update is performed through the `path` and `url` options, and the way to configure it depends on the provider type (multi-provider o single-provider). You can find this process explained in the Vulnerability Detector documentation.\r\n\r\n**Configuration sample**\r\n\r\n\r\n``` XML\r\n  <vulnerability-detector>\r\n    <enabled>yes</enabled>\r\n    <interval>100d</interval>\r\n    <run_on_start>yes</run_on_start>\r\n    <provider name=\"canonical\">\r\n      <enabled>yes</enabled>\r\n      <os url=\"http://local_repo/com.ubuntu.bionic.cve.oval.xml\">bionic</os>\r\n      <os url=\"http://local_repo/com.ubuntu.xenial.cve.oval.xml\">xenial</os>\r\n      <os path=\"/local_path/com.ubuntu.trusty.cve.oval.xml\">trusty</os>\r\n      <os path=\"/local_path/com.ubuntu.precise.cve.oval.xml\">precise</os>\r\n      <update_interval>1h</update_interval>\r\n    </provider>\r\n    <provider name=\"debian\">\r\n      <enabled>yes</enabled>\r\n      <os url=\"http://local_repo/oval-definitions-stretch.xml\">stretch</os>\r\n      <os url=\"http://local_repo/oval-definitions-jessie.xml\">jessie</os>\r\n      <os path=\"/local_path/oval-definitions-wheezy.xml\">wheezy</os>\r\n      <update_interval>1h</update_interval>\r\n    </provider>\r\n    <provider name=\"redhat\">\r\n      <enabled>yes</enabled>\r\n      <path>/local_path/rh-feed/redhat-feed.*json$</path>\r\n      <update_interval>1h</update_interval>\r\n    </provider>\r\n    <provider name=\"nvd\">\r\n      <enabled>yes</enabled>\r\n      <url start=\"2002\" end=\"2019\">http://local_repo/rh-feed/redhat-feed[-].json</url>\r\n      <update_interval>1h</update_interval>\r\n    </provider>\r\n  </vulnerability-detector>\r\n```\r\n\r\n**Min/Max compatible versions**\r\n3.11.0 - Current\r\n\r\n**Expected logs**\r\n\r\nIf you perform a vulnerability update with a configuration like the one above, which is covering all the cases, you should see the following log sequence:\r\n\r\n\r\n> 2019/09/26 07:26:30 wazuh-modulesd:vulnerability-detector: INFO: (5461): Starting Ubuntu Bionic database update.\r\n> 2019/09/26 07:26:37 wazuh-modulesd:vulnerability-detector: INFO: (5494): The update of the Ubuntu Bionic feed finished successfully.\r\n> 2019/09/26 07:26:37 wazuh-modulesd:vulnerability-detector: INFO: (5461): Starting Ubuntu Xenial database update.\r\n> 2019/09/26 07:26:48 wazuh-modulesd:vulnerability-detector: INFO: (5494): The update of the Ubuntu Xenial feed finished successfully.\r\n> 2019/09/26 07:26:48 wazuh-modulesd:vulnerability-detector: INFO: (5461): Starting Ubuntu Trusty database update.\r\n> 2019/09/26 07:26:59 wazuh-modulesd:vulnerability-detector: INFO: (5494): The update of the Ubuntu Trusty feed finished successfully.\r\n> 2019/09/26 07:26:59 wazuh-modulesd:vulnerability-detector: INFO: (5461): Starting Ubuntu Precise database update.\r\n> 2019/09/26 07:27:09 wazuh-modulesd:vulnerability-detector: INFO: (5494): The update of the Ubuntu Precise feed finished successfully.\r\n> 2019/09/26 07:27:09 wazuh-modulesd:vulnerability-detector: INFO: (5461): Starting Debian Stretch database update.\r\n> 2019/09/26 07:27:17 wazuh-modulesd:vulnerability-detector: INFO: (5494): The update of the Debian Stretch feed finished successfully.\r\n> 2019/09/26 07:27:17 wazuh-modulesd:vulnerability-detector: INFO: (5461): Starting Debian Jessie database update.\r\n> 2019/09/26 07:27:26 wazuh-modulesd:vulnerability-detector: INFO: (5494): The update of the Debian Jessie feed finished successfully.\r\n> 2019/09/26 07:27:26 wazuh-modulesd:vulnerability-detector: INFO: (5461): Starting Debian Wheezy database update.\r\n> 2019/09/26 07:27:27 wazuh-modulesd:vulnerability-detector: INFO: (5494): The update of the Debian Wheezy feed finished successfully.\r\n> 2019/09/26 07:27:27 wazuh-modulesd:vulnerability-detector: INFO: (5461): Starting Red Hat Enterprise Linux database update.\r\n> 2019/09/26 07:27:59 wazuh-modulesd:vulnerability-detector: INFO: (5494): The update of the Red Hat Enterprise Linux feed finished successfully.\r\n> 2019/09/26 07:28:00 wazuh-modulesd:vulnerability-detector: INFO: (5461): Starting National Vulnerability Database database update.\r\n> 2019/09/26 07:31:06 wazuh-modulesd:vulnerability-detector: INFO: (5494): The update of the National Vulnerability Database feed finished successfully.\r\n\r\n\r\n## VUL009\r\n\r\n**Short description**\r\n\r\nVulnerability-detector must be able to analyze vulnerabilities in all supported agents.\r\n\r\n**Category**\r\n\r\nVulnerability-detector\r\n\r\n**Subcategory**\r\n\r\nVulnerability detection\r\n\r\n**Description**\r\n\r\nAll supported OS must be taken into account when a vulnerability scan is performed. To check it, connect an agent of each supported system and enable its feeds.\r\n\r\n**Configuration sample**\r\n\r\n\r\n``` XML\r\n  <vulnerability-detector>\r\n    <enabled>yes</enabled>\r\n    <interval>1m</interval>\r\n    <run_on_start>yes</run_on_start>\r\n    <provider name=\"canonical\">\r\n      <enabled>yes</enabled>\r\n      <os>bionic</os>\r\n      <os>xenial</os>\r\n      <os>trusty</os>\r\n      <os>precise</os>\r\n      <update_interval>1h</update_interval>\r\n    </provider>\r\n    <provider name=\"debian\">\r\n      <enabled>yes</enabled>\r\n      <os>stretch</os>\r\n      <os>jessie</os>\r\n      <os>wheezy</os>\r\n      <update_interval>1h</update_interval>\r\n    </provider>\r\n    <provider name=\"redhat\">\r\n      <enabled>yes</enabled>\r\n      <update_interval>1h</update_interval>\r\n    </provider>\r\n    <provider name=\"nvd\">\r\n      <enabled>yes</enabled>\r\n      <update_interval>1h</update_interval>\r\n    </provider>\r\n  </vulnerability-detector>\r\n```\r\n\r\n**Min/Max compatible versions**\r\n3.11.0 - Current\r\n\r\n**Expected logs**\r\n\r\nYou should be an ID `5486` message for each supported agent with modulesd in debug mode of level 1. If there is an agent with a supported OS that is not displayed with this log, the test fails.\r\n\r\n> 2019/09/26 08:04:07 wazuh-modulesd:vulnerability-detector[5303] wm_vuln_detector.c:1029 at wm_vuldet_check_agent_vulnerabilities(): DEBUG: (5486): Starting vulnerability assessment for agent 47.\r\n\r\n\r\n## VUL010\r\n\r\n**Short description**\r\n\r\nVulnerability-detector must ignore the unsupported agents.\r\n\r\n**Category**\r\n\r\nVulnerability-detector\r\n\r\n**Subcategory**\r\n\r\nVulnerability detection\r\n\r\n**Description**\r\n\r\nThis test is the reverse of `VUL009`. It consists on to verify that all continue working if an unsupported agent is connected to de manager.\r\n\r\nAn agent may be unsupported because the module does not accept its distribution, such as Fedora, or because of its version (Debian Sid).\r\n\r\n**Configuration sample**\r\n\r\nDoesn't matter.\r\n\r\n**Min/Max compatible versions**\r\n3.11.0 - Current\r\n\r\n**Expected logs**\r\n\r\nSince this test is the reverse of `VUL009`, verify that the `ossec.log` file does not have a false positive of that test.\r\n\r\n\r\n## VUL011\r\n\r\n**Short description**\r\n\r\nVulnerability-detector must allow checking vulnerabilities in an unsupported agent if the user specifies it.\r\n\r\n**Category**\r\n\r\nVulnerability-detector\r\n\r\n**Subcategory**\r\n\r\nVulnerability detection\r\n\r\n**Description**\r\n\r\nThe `allow` option of Vulnerability Detector is used to configure the vulnerability scan of an unsupported OS by simulating that the agent system is supported.\r\n\r\n**Configuration sample**\r\n\r\nTo test it, connect several agents of similar or derivated distributions to the manager and configure its monitoring using this tag.\r\n\r\nThe following configuration example is adding support for `Pop! OS 16` and `Ubuntu 15` as if they were `Ubuntu 16`, `Linux Mint 19` as `Ubuntu 18`, `Oracle Linux 7` as `Red Hat 7`, and `Oracle Linux 6` as `Red Hat 6`.\r\n\r\n``` XML\r\n  <vulnerability-detector>\r\n    <enabled>yes</enabled>\r\n    <interval>1m</interval>\r\n    <run_on_start>yes</run_on_start>\r\n    <provider name=\"canonical\">\r\n      <enabled>no</enabled>\r\n      <os allow=\"Pop!_OS-16,Ubuntu-15\">xenial</os>\r\n      <os allow=\"Linux Mint-19\">bionic</os>\r\n      <update_interval>1h</update_interval>\r\n    </provider>\r\n    <provider name=\"redhat\">\r\n      <enabled>yes</enabled>\r\n      <allow replaced_os=\"Red Hat-7\">Oracle Linux-7</allow>\r\n      <allow replaced_os=\"Red Hat-6\">Oracle Linux-6</allow>\r\n      <update_interval>1h</update_interval>\r\n      <update_from_year>2010</update_from_year>\r\n    </provider>\r\n  </vulnerability-detector>\r\n```\r\n\r\nYou can find more information about how to configure this option in the documentation.\r\n\r\n**Min/Max compatible versions**\r\n3.11.0 - Current\r\n\r\n**Expected logs**\r\n\r\nYou can verify that the agent is being taken into account with the check from `VUL009`.\r\n\r\n\r\n## VUL012\r\n\r\n**Short description**\r\n\r\nVulnerability-detector must be retro compatible with old configuration structures.\r\n\r\n**Category**\r\n\r\nVulnerability-detector\r\n\r\n**Subcategory**\r\n\r\nVulnerability detection\r\n\r\n**Description**\r\n\r\nThe module has to accept the deprecated configuration structure to guarantee that the manager does not break between updates for this reason.\r\n\r\n**Configuration sample**\r\n\r\n``` XML\r\n  <wodle name=\"vulnerability-detector\">\r\n    <disabled>no</disabled>\r\n    <interval>1d</interval>\r\n    <run_on_start>yes</run_on_start>\r\n    <update_ubuntu_oval interval=\"60m\" version=\"16,14\">yes</update_ubuntu_oval>\r\n    <update_redhat_oval interval=\"60m\" version=\"7,6\">yes</update_redhat_oval>\r\n  </wodle>\r\n```\r\n\r\n**Min/Max compatible versions**\r\n3.11.0 - 4.0\r\n\r\n**Expected logs**\r\n\r\nIt is expected to find log messages warning about that configuration is deprecated.\r\n\r\n> 2019/09/26 08:04:07 wazuh-modulesd:vulnerability-detector[5303] WARN: This vulnerability-detector declaration is deprecated. Use <vulnerability-detector> instead.\r\n\r\n\r\n## VUL013\r\n\r\n**Short description**\r\n\r\nVulnerability-detector must respect the scan interval specifies for `<ignore_time>` for each agent independently.\r\n\r\n**Category**\r\n\r\nVulnerability-detector\r\n\r\n**Subcategory**\r\n\r\nVulnerability detection\r\n\r\n**Description**\r\n\r\nThe `<ignore_time>` option is used to configure the interval time during the agent will not be fully scanned. This means during that time only the new packages of the agent, or those that have been updated will be analyzed.\r\n\r\nNote that this option defines an interval for each agent, and the time must start to count when the first scan of the agent is performed.\r\n\r\nThe test must also verify that the ignore interval is respected, and not restarted, between manager restarts.\r\n\r\n**Configuration sample**\r\n\r\nThe following block configures an ignore interval of 6 hours, which is the default value if the option is not specified.\r\n\r\n``` XML\r\n\r\n  <vulnerability-detector>\r\n    <enabled>yes</enabled>\r\n    <interval>5m</interval>\r\n    <ignore_time>6h</ignore_time>\r\n    <run_on_start>yes</run_on_start>\r\n    <provider name=\"canonical\">\r\n      <enabled>yes</enabled>\r\n      <os>precise</os>\r\n      <os>trusty</os>\r\n      <os>xenial</os>\r\n      <os>bionic</os>\r\n      <update_interval>1h</update_interval>\r\n    </provider>\r\n    <provider name=\"debian\">\r\n      <enabled>yes</enabled>\r\n      <os>wheezy</os>\r\n      <os>stretch</os>\r\n      <os>jessie</os>\r\n      <update_interval>1h</update_interval>\r\n    </provider>\r\n    <provider name=\"redhat\">\r\n      <enabled>yes</enabled>\r\n      <update_from_year>2010</update_from_year>\r\n      <update_interval>1h</update_interval>\r\n    </provider>\r\n    <provider name=\"nvd\">\r\n      <enabled>yes</enabled>\r\n      <update_from_year>2010</update_from_year>\r\n      <update_interval>1h</update_interval>\r\n    </provider>\r\n  </vulnerability-detector>\r\n```\r\n\r\n**Min/Max compatible versions**\r\n3.11.0 - current\r\n\r\n**Expected logs**\r\n\r\nYou should see the following debug messages with the ignore time has not been reached and a scan is performed.\r\n\r\n> 2019/09/26 09:46:57 wazuh-modulesd:vulnerability-detector[6099] wm_vuln_detector.c:2815 at wm_vuldet_get_software_info(): DEBUG: (5574): A partial scan will be run on agent 47.\r\n> 2019/09/26 09:46:57 wazuh-modulesd:vulnerability-detector[6099] wm_vuln_detector.c:2950 at wm_vuldet_get_software_info(): DEBUG: (5475): No changes have been found with respect to the last package inventory for agent 47.\r\n\r\n## VUL014\r\n\r\n**Short description**\r\n\r\nVulnerability-detector must scan an agent if it has hotfix or package inventory.\r\n\r\n**Category**\r\n\r\nVulnerability-detector\r\n\r\n**Subcategory**\r\n\r\nVulnerability detection\r\n\r\n**Description**\r\n\r\nVulnerability Detector checks if there is a package inventory available for each Linux agent to decide if the agent has to be scanned or not. However, this check is not the same for Windows agents since they can also be scanned if a hotfixes inventory is available.\r\n\r\nThe purpose of this test is to verify if Vulnerability Detector takes into account the supported agents with a package/hotfixes inventory, or discards them otherwise.\r\n\r\nTo see the related messages modulesd must be launched with level 1 debug. The message code which confirms that an agent is going to be reported is `5454`.\r\n\r\n**Configuration sample**\r\n\r\nThe following configuration will help us to cover all use cases combining it with agents of different type and configuration.\r\n\r\n``` XML\r\n  <vulnerability-detector>\r\n    <enabled>yes</enabled>\r\n    <interval>5m</interval>\r\n    <ignore_time>6h</ignore_time>\r\n    <run_on_start>yes</run_on_start>\r\n    <provider name=\"canonical\">\r\n      <enabled>yes</enabled>\r\n      <os>xenial</os>\r\n      <update_interval>1h</update_interval>\r\n    </provider>\r\n    <provider name=\"redhat\">\r\n      <enabled>yes</enabled>\r\n      <update_from_year>2010</update_from_year>\r\n      <update_interval>1h</update_interval>\r\n    </provider>\r\n    <provider name=\"nvd\">\r\n      <enabled>yes</enabled>\r\n      <update_from_year>2010</update_from_year>\r\n      <update_interval>1h</update_interval>\r\n    </provider>\r\n  </vulnerability-detector>\r\n```\r\n\r\nUsing this configuration, the test should replicate an environment such as the following or similar.\r\n\r\nAn Ubuntu Xenial manager with the following configuration for Syscollector:\r\n\r\n``` XML\r\n  <wodle name=\"syscollector\">\r\n    <disabled>no</disabled>\r\n    <interval>1h</interval>\r\n    <scan_on_start>yes</scan_on_start>\r\n    <packages>yes</packages>\r\n  </wodle>\r\n```\r\n\r\nA Windows agent with the packages scan disabled, but which will be able to scan hotfixes.\r\n\r\n``` XML\r\n  <wodle name=\"syscollector\">\r\n    <disabled>no</disabled>\r\n    <interval>1h</interval>\r\n    <scan_on_start>yes</scan_on_start>\r\n    <os>yes</os> \r\n    <packages>no</packages>\r\n  </wodle>\r\n```\r\n\r\nA Centos 7 agent with the package scan disabled:\r\n\r\n``` XML\r\n  <wodle name=\"syscollector\">\r\n    <disabled>no</disabled>\r\n    <interval>1h</interval>\r\n    <scan_on_start>yes</scan_on_start>\r\n    <packages>no</packages>\r\n  </wodle>\r\n```\r\n\r\nAnother Windows agent with Syscollector disabled:\r\n\r\n``` XML\r\n  <wodle name=\"syscollector\">\r\n    <disabled>yes</disabled>\r\n    <interval>1h</interval>\r\n    <scan_on_start>yes</scan_on_start>\r\n  </wodle>\r\n```\r\n\r\n**Min/Max compatible versions**\r\n3.11.0 - current\r\n\r\n**Expected logs**\r\n\r\nUsing the previous configuration, and taking into account that the agents with deactivated scans have not sent any before, these are the expected logs:\r\n\r\n> 2019/10/09 16:21:35 wazuh-modulesd:vulnerability-detector[30183] wm_vuln_detector.c:4975 at wm_vuldet_run_scan(): INFO: (5452): Starting vulnerability scanning.\r\n> 2019/10/09 16:21:35 wazuh-modulesd:vulnerability-detector[30183] wm_vuln_detector.c:1028 at wm_vuldet_check_agent_vulnerabilities(): DEBUG: (5486): Starting vulnerability assessment for agent 0.\r\n> 2019/10/09 16:21:35 wazuh-modulesd:vulnerability-detector[30183] wm_vuln_detector.c:2752 at wm_vuldet_get_software_info(): DEBUG: (5462): Getting agent 0 software.\r\n> 2019/10/09 16:21:35 wazuh-modulesd:vulnerability-detector[30183] wm_vuln_detector.c:2763 at wm_vuldet_get_software_info(): DEBUG: (5573): A full scan will be run on agent 0.\r\n\r\nThe module notifies that the agent 0 (the manager) can bee fully analyzed because it is its first scan, or the ignore time has been reached.\r\n\r\n> 2019/10/09 16:21:35 wazuh-modulesd:vulnerability-detector[30183] wm_vuln_detector.c:1028 at wm_vuldet_check_agent_vulnerabilities(): DEBUG: (5486): Starting vulnerability assessment for agent 1.\r\n> 2019/10/09 16:21:35 wazuh-modulesd:vulnerability-detector[30183] wm_vuln_detector.c:2752 at wm_vuldet_get_software_info(): DEBUG: (5462): Getting agent 1 software.\r\n> 2019/10/09 16:21:35 wazuh-modulesd:vulnerability-detector[30183] wm_vuln_detector.c:2763 at wm_vuldet_get_software_info(): DEBUG: (5573): A full scan will be run on agent 1.\r\n> 2019/10/09 16:21:35 wazuh-modulesd:vulnerability-detector[30183] wm_vuln_detector.c:2784 at wm_vuldet_get_software_info(): DEBUG: (5576): The package inventory of the agent 1 is not available, but an hotfix analysis will be launched.\r\n\r\nThe first Windows agent does not have the package inventory available but will try to analyze its hotfixes.\r\n\r\n> 2019/10/09 16:21:35 wazuh-modulesd:vulnerability-detector[30183] wm_vuln_detector.c:1028 at wm_vuldet_check_agent_vulnerabilities(): DEBUG: (5486): Starting vulnerability assessment for agent 3.\r\n> 2019/10/09 16:21:35 wazuh-modulesd:vulnerability-detector[30183] wm_vuln_detector.c:2752 at wm_vuldet_get_software_info(): DEBUG: (5462): Getting agent 3 software.\r\n> 2019/10/09 16:21:35 wazuh-modulesd:vulnerability-detector[30183] wm_vuln_detector.c:2763 at wm_vuldet_get_software_info(): DEBUG: (5573): A full scan will be run on agent 3.\r\n> 2019/10/09 16:21:35 wazuh-modulesd:vulnerability-detector[30183] wm_vuln_detector.c:2779 at wm_vuldet_get_software_info(): DEBUG: (5434): No package inventory found for agent 3, so their vulnerabilities will not be checked.\r\n\r\nAgent 3 (Centos 7) is directly discarded due to it does not have the necessary package scan.\r\n\r\n> 2019/10/09 16:21:35 wazuh-modulesd:vulnerability-detector[30183] wm_vuln_detector.c:1028 at wm_vuldet_check_agent_vulnerabilities(): DEBUG: (5486): Starting vulnerability assessment for agent 4.\r\n> 2019/10/09 16:21:35 wazuh-modulesd:vulnerability-detector[30183] wm_vuln_detector.c:2752 at wm_vuldet_get_software_info(): DEBUG: (5462): Getting agent 4 software.\r\n> 2019/10/09 16:21:35 wazuh-modulesd:vulnerability-detector[30183] wm_vuln_detector.c:2763 at wm_vuldet_get_software_info(): DEBUG: (5573): A full scan will be run on agent 4.\r\n> 2019/10/09 16:21:35 wazuh-modulesd:vulnerability-detector[30183] wm_vuln_detector.c:2784 at wm_vuldet_get_software_info(): DEBUG: (5576): The package inventory of the agent 4 is not available, but an hotfix analysis will be launched.\r\n> 2019/10/09 16:21:35 wazuh-modulesd:vulnerability-detector[30183] wm_vuln_detector.c:2860 at wm_vuldet_get_software_info(): DEBUG: (5577): It is not possible to perform a hotfix scan on agent 4.\r\n\r\nOn the other hand, agent 4 (Windows) has no inventory of hotfixes or packages available, so it will also be discarded.\r\n\r\n> 2019/10/09 16:21:35 wazuh-modulesd:vulnerability-detector[30183] wm_vuln_detector.c:856 at wm_vuldet_report_agent_vulnerabilities(): DEBUG: (5454): Analyzing agent 1 vulnerabilities.\r\n> 2019/10/09 16:21:35 wazuh-modulesd:vulnerability-detector[30183] wm_vuln_detector.c:992 at wm_vuldet_report_agent_vulnerabilities(): DEBUG: (5487): Finished vulnerability assessment for agent 1.\r\n> 2019/10/09 16:21:35 wazuh-modulesd:vulnerability-detector[30183] wm_vuln_detector.c:856 at wm_vuldet_report_agent_vulnerabilities(): DEBUG: (5454): Analyzing agent 0 vulnerabilities.\r\n> 2019/10/09 16:21:36 wazuh-modulesd:vulnerability-detector[30183] wm_vuln_detector.c:992 at wm_vuldet_report_agent_vulnerabilities(): DEBUG: (5487): Finished vulnerability assessment for agent 0.\r\n> 2019/10/09 16:21:36 wazuh-modulesd:vulnerability-detector[30183] wm_vuln_detector.c:4983 at wm_vuldet_run_scan(): INFO: (5453): Vulnerability scanning finished.\r\n\r\nFinally, we can see that only the agents 1 and 0 has been scanned.\r\n\r\n\r\n## VUL015\r\n\r\n**Short description**\r\n\r\nVulnerability-detector must not report as vulnerable the software that has been updated if Syscollector has notified it.\r\n\r\n**Category**\r\n\r\nVulnerability-detector\r\n\r\n**Subcategory**\r\n\r\nVulnerability detection\r\n\r\n**Description**\r\n\r\nThe purpose of this test is to verify that the module is useful for locating packages that need to be updated and correcting their vulnerabilities.\r\n\r\nTo verify it for Windows and Linux programs, we can install a vulnerable version, check how it is reported, and fix it.\r\n\r\nThe test is different for those vulnerabilities which can only be fixed by installing a hotfix.\r\n\r\n**Configuration sample**\r\n\r\nThe use case of this test will be a vulnerable Ubuntu Bionic manager and a Windows Server 2008 R2 agent. We can use this configuration:\r\n\r\n``` XML\r\n  <vulnerability-detector>\r\n    <enabled>yes</enabled>\r\n    <interval>5m</interval>\r\n    <ignore_time>6h</ignore_time>\r\n    <run_on_start>yes</run_on_start>\r\n    <provider name=\"canonical\">\r\n      <enabled>yes</enabled>\r\n      <os>bionic</os>\r\n      <update_interval>1h</update_interval>\r\n    </provider>\r\n    <provider name=\"nvd\">\r\n      <enabled>yes</enabled>\r\n      <update_from_year>2010</update_from_year>\r\n      <update_interval>1h</update_interval>\r\n    </provider>\r\n  </vulnerability-detector>\r\n```\r\n\r\nFor Syscollector:\r\n\r\n``` XML\r\n  <wodle name=\"syscollector\">\r\n    <disabled>no</disabled>\r\n    <interval>1h</interval>\r\n    <scan_on_start>yes</scan_on_start>\r\n    <packages>yes</packages>\r\n    <packages>os</packages>\r\n  </wodle>\r\n```\r\n\r\n**Min/Max compatible versions**\r\n3.11.0 - current\r\n\r\n**Expected logs**\r\n\r\nWe can start the test by installing the `libkrb5support0` package to a vulnerable version (`1.16-2ubuntu0.1`) as follows:\r\n\r\n\r\n``` BASH\r\napt install libkrb5support0=1.16-2ubuntu0.1\r\n```\r\n\r\nAfter this, the next scan should trigger the next alert:\r\n\r\n```\r\n** Alert 1571046780.345938: - vulnerability-detector,gdpr_IV_35.7.d,\r\n2019 Oct 14 09:53:00 8d31315b480e->vulnerability-detector\r\nRule: 23503 (level 5) -> 'CVE-2018-5710 on Ubuntu 18.04 LTS (bionic) - low.'\r\n{\"vulnerability\":{\"cve\":\"CVE-2018-5710\",\"title\":\"CVE-2018-5710 on Ubuntu 18.04 LTS (bionic) - low.\",\"severity\":\"Low\",\"published\":\"2018-01-16T09:29:00Z\",\"state\":\"Fixed\",\"software\":{\"name\":\"libkrb5support0\",\"version\":\"1.16-2ubuntu0.1\",\"architecture\":\"amd64\"},\"condition\":\"Package less than 1.16.1-1\",\"reference\":\"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5710\"}}\r\nvulnerability.cve: CVE-2018-5710\r\nvulnerability.title: CVE-2018-5710 on Ubuntu 18.04 LTS (bionic) - low.\r\nvulnerability.severity: Low\r\nvulnerability.published: 2018-01-16T09:29:00Z\r\nvulnerability.state: Fixed\r\nvulnerability.software.name: libkrb5support0\r\nvulnerability.software.version: 1.16-2ubuntu0.1\r\nvulnerability.software.architecture: amd64\r\nvulnerability.condition: Package less than 1.16.1-1\r\nvulnerability.reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5710\r\n```\r\n\r\nIt is not necessary to wait for the ignore time to expire because new or updated packages are always analyzed.\r\n\r\nIf we set the debug level to 2 and filter by the package we should see a message indicating that the package is vulnerable and the condition to confirm the vulnerability.\r\n\r\n> 2019/10/14 09:57:54 wazuh-modulesd:vulnerability-detector[3641] wm_vuln_detector.c:946 at wm_vuldet_report_agent_vulnerabilities(): DEBUG: (5467): The 'libkrb5support0' package from agent 0 is vulnerable to CVE-2018-5710. Condition: package version (1.16-2ubuntu0.1) less than 1.16.1-1.\r\n\r\nFinally, if we update the package and Syscollector index that change:\r\n\r\n> 2019/10/14 10:18:45 wazuh-modulesd:vulnerability-detector[4122] wm_vuln_detector.c:939 at wm_vuldet_report_agent_vulnerabilities(): DEBUG: (5456): The 'libkrb5support0' package from agent 0 is not vulnerable to CVE-2018-5710. Condition: package version (1.16.3-3.1) less than 1.16.1-1.\r\n\r\nFor the Windows vulnerability, we will use a Windows Server 2008 R2 which is vulnerable to `CVE-2017-0055` for not having the `KB4012212` hotfix installed. We should see the following alert.\r\n\r\n```\r\n** Alert 1571048511.2019462: - vulnerability-detector,gdpr_IV_35.7.d,\r\n2019 Oct 14 10:21:51 (agwin) 172.16.210.128->vulnerability-detector\r\nRule: 23504 (level 7) -> 'Microsoft Internet Information Server (IIS) in Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to perform cross-site scripting and run script with local user privileges via a crafted request, aka \"Microsoft IIS Server XSS Elevation of Privilege Vulnerability.\"'\r\n{\"vulnerability\":{\"cve\":\"CVE-2017-0055\",\"title\":\"Microsoft Internet Information Server (IIS) in Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to perform cross-site scripting and run script with local user privileges via a crafted request, aka \\\"Microsoft IIS Server XSS Elevation of Privilege Vulnerability.\\\"\",\"severity\":\"Medium\",\"published\":\"2017-03-17\",\"updated\":\"2017-07-12\",\"state\":\"Fixed\",\"cvss\":{\"cvss2\":{\"vector\":{\"attack_vector\":\"network\",\"access_complexity\":\"medium \",\"authentication\":\"none\",\"integrity_impact\":\"partial \",\"availability\":\"none\"},\"base_score\":4.3},\"cvss3\":{\"vector\":{\"attack_vector\":\"network\",\"access_complexity\":\"low\",\"confidentiality_impact\":\"low\",\"availability\":\"none\",\"privileges_required\":\"none\",\"user_interaction\":\"required \",\"scope\":\"changed \"},\"base_score\":6.1}},\"software\":{\"name\":\"Windows Server 2008 R2\",\"generated_cpe\":\"o:microsoft:windows_server_2008:r2:sp1::::::\"},\"condition\":\"4012212 patch is not installed.\",\"cwe_reference\":\"CWE-79\",\"reference\":\"http://www.securityfocus.com/bid/96622\"}}\r\nvulnerability.cve: CVE-2017-0055\r\nvulnerability.title: Microsoft Internet Information Server (IIS) in Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to perform cross-site scripting and run script with local user privileges via a crafted request, aka \"Microsoft IIS Server XSS Elevation of Privilege Vulnerability.\"\r\nvulnerability.severity: Medium\r\nvulnerability.published: 2017-03-17\r\nvulnerability.updated: 2017-07-12\r\nvulnerability.state: Fixed\r\nvulnerability.cvss.cvss2.vector.attack_vector: network\r\nvulnerability.cvss.cvss2.vector.access_complexity: medium \r\nvulnerability.cvss.cvss2.vector.authentication: none\r\nvulnerability.cvss.cvss2.vector.integrity_impact: partial \r\nvulnerability.cvss.cvss2.vector.availability: none\r\nvulnerability.cvss.cvss2.base_score: 4.300000\r\nvulnerability.cvss.cvss3.vector.attack_vector: network\r\nvulnerability.cvss.cvss3.vector.access_complexity: low\r\nvulnerability.cvss.cvss3.vector.confidentiality_impact: low\r\nvulnerability.cvss.cvss3.vector.availability: none\r\nvulnerability.cvss.cvss3.vector.privileges_required: none\r\nvulnerability.cvss.cvss3.vector.user_interaction: required \r\nvulnerability.cvss.cvss3.vector.scope: changed \r\nvulnerability.cvss.cvss3.base_score: 6.100000\r\nvulnerability.software.name: Windows Server 2008 R2\r\nvulnerability.software.generated_cpe: o:microsoft:windows_server_2008:r2:sp1::::::\r\nvulnerability.condition: 4012212 patch is not installed.\r\nvulnerability.cwe_reference: CWE-79\r\nvulnerability.reference: http://www.securityfocus.com/bid/96622\r\n```\r\n\r\nWe can download the patch suggested by the alert from https://www.catalog.update.microsoft.com/search.aspx?q=kb4012212.\r\n\r\nAfter applying the hotfix, and once the agent has updated its hotfix inventory through Syscollector, we will see the following debug message in Vulnerability Detector when running a full-scan.\r\n\r\n> 2019/10/14 10:29:42 wazuh-modulesd:vulnerability-detector[4463] wm_vuln_detector_nvd.c:2611 at wm_vuldet_check_hotfix(): DEBUG: (5534): Agent 1 has installed KB4012212 that corrects the vulnerability CVE-2017-0055.\r\n\r\nNote that the hotfixes scan is only performed each time a full-scan is launched, or in other words, each time the value set by `<ignore_time>` is reached. Only packages can be scanned with a partial scan."}}
{"actor":{"display_login":"crolopez"}}