Skip to content

Commit f678059

Browse files
Sep0lkitSep0lkit
committed
new posts: oval language
1 parent 6806f6c commit f678059

File tree

8 files changed

+321
-17
lines changed

8 files changed

+321
-17
lines changed

‎posts/OVAL 语法简介与示例.md

Lines changed: 233 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -2,29 +2,246 @@
22

33
- **OVAL 简介**
44

5-
https://oval.mitre.org/language/about/overview.html
5+
- **OVAL 与 SCAP**
6+
- **工作原理**
7+
- **应用场景**
8+
- **OVAL仓库**
9+
- **OVAL 语法**
10+
- 语法结构
11+
- **defintions**
12+
- **tests**
13+
- **objects**
14+
- **states**
15+
- **variables**
16+
- **OVAL 示例**
17+
- **OVAL 资源**
18+
- **其他**
19+
- oscap 系统漏洞评估
20+
- 威胁情报源
21+
- hids 系统实现资产和漏洞评估
622

7-
OVAL 是SCAP 的基础语言, XCCDF CPE 都是基于 OVAL 实现的.
23+
## OVAL简介
824

9-
- Classes
25+
OVAL全称Open Vulnerability and Assessment Language, 即开放漏洞评估语言
1026

11-
- OVAL 语法格式
27+
OVAL是由MITER公司开发维护, 旨在标准化计算机系统安全状态评估, 提供开放和公开的系统安全评估检测内容. 目前OVAL项目捐赠给CIS, 可以在全球范围内免费使用.
1228

13-
- defintions
29+
**OVAL官网:**
1430

15-
- tests
31+
https://oval.cisecurity.org/ (CIS)
1632

17-
oval 支持的 tests 模块
33+
https://oval.mitre.org/ (MITRE)
1834

19-
- objects
35+
### OVAL 与 SCAP
2036

21-
- states
37+
OVAL是SCAP协议的基础组件之一, 也是其他组件的依赖组件, 如XCCDE/CPE等都是通过OVAL来定义的. 所以OVAL是SCAP协议的最基础的语言, 下面我们就讲一下OVAL语言的工作原理/有什么优势/可以解决那些问题/OVAL语法格式, 以及OVAL示例Demo.
2238

23-
- vaules
39+
### 工作原理
2440

25-
- **OVAL 示例**
26-
- **OVAL 资源与应用**
27-
- 思考
28-
- oscap 系统漏洞评估
29-
- 威胁情报源
30-
- hids 系统实现资产和漏洞评估
41+
OVAL语言规范三个主要步骤, 用于实现计算机系统的安全状态评估:
42+
43+
- 系统数据定义, 用于收集系统数据进行测试
44+
- 数据状态定义: 判断系统数据(漏洞/配置/补丁)是否符合定义的状态
45+
- 数据状态结果: 输出系统当前状态评估报告
46+
47+
我们可以将前两个步骤定义成xml文件, 通过oscap工具在待测系统上进行解析运行, 输出评估报告. 后面也会通过OVAL示例进行具体的说明.
48+
49+
### 应用场景
50+
51+
OVAL语言有什么优势, 他能解决那些问题? OVAL主要的应用场景有那些呢?
52+
53+
**应用场景:**
54+
55+
- 漏洞定义分析
56+
- 资产定义分析
57+
- 配置定义分析
58+
59+
**优势/解决的问题:**
60+
61+
- 明确给定系统是否存在软件漏洞/补丁/配置合规的检测方法
62+
- 基于可扩展标记语言(XML), 使用单个xml文档对问题进行详细描述
63+
- 合作支持, 系统发行商提供提供OVAL检测xml文档(redhat/ubuntu/cisco等)
64+
65+
OVAL应用的场景包括漏洞/资产/配置, 实际中OVAL主要用于漏洞定义. 资产以及配置应用场景结合其他语言来用如CPE/XCCDF, 下面我们从漏洞定义场景来介绍OVAL, 其他场景见后续文章.
66+
67+
### OVAL仓库
68+
69+
​ CIS提供了主流发行商的的oval漏洞定义文件, 可以直接下载使用.
70+
71+
**下载地址:**
72+
73+
​ https://oval.cisecurity.org/repository/download
74+
75+
> 注: 由于各个厂商支持力度以及开源社区等产品的关系, OVAL在落地实现是比较鸡肋的, 但是这套理念和技术标准, 还是有很大的指导意义.
76+
77+
## OVAL语法
78+
79+
### 语法结构
80+
81+
**OVAL文档结构**
82+
83+
```xml
84+
<?xml version="1.0" encoding="utf-8"?>
85+
<!-- namespace 与 schema声明-->
86+
<oval_definitions>
87+
<!-- xml文档信息(版本/发布时间等) -->
88+
<generator>
89+
</generator>
90+
91+
<!-- OVAL定义, 由若干条definition组成, 每一条definition包含若干属性和元素, 其中criteria为definition判断条件, 相应的tests查到object和state对比判断此definion是否存在-->
92+
<!-- 说明1: definition属性class表示此定义的类别, 目前OVAL的类别有: compliance/inventory/miscellaneous/patch/vulnerablitity -->
93+
<!-- 说明2: criteria由多条criterion组成判断逻辑, 通过criterion引用的test返回Bool型的值做逻辑运算 -->
94+
<!-- 说明3: 这个是redhat提供的关于redhat oval的部分, 可以看到redhat的oval定义信息非常详细, 关于系统漏洞的所有信息, 我们基本都可以从这里获取的到 -->
95+
<definitions>
96+
<definition class="patch" id="" version="">
97+
<metadata>
98+
<title>RHSA-2019:0710: python security update (Important)</title>
99+
<affected family="unix">
100+
<platform>Red Hat Enterprise Linux 7</platform>
101+
</affected>
102+
<reference ref_id="RHSA-2019:0710-01" ref_url="" source="RHSA"/>
103+
<reference ref_id="CVE-2019-9636" ref_url="" source="CVE"/>
104+
<description></description>
105+
<advisory from="secalert@redhat.com">
106+
<severity>Important</severity>
107+
<rights>Copyright 2019 Red Hat, Inc.</rights>
108+
<issued date="2019-04-08"/>
109+
<updated date="2019-04-08"/>
110+
<cve cvss3="9.8/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" cwe="CWE-172" href="" public="20190306">CVE-2019-9636</cve>
111+
<bugzilla href="" id="1688543"></bugzilla>
112+
<affected_cpe_list>
113+
<cpe>cpe:/o:redhat:enterprise_linux:7</cpe>
114+
</affected_cpe_list>
115+
</advisory>
116+
</metadata>
117+
<criteria operator="AND">
118+
<criteria operator="OR">
119+
<criterion comment="Red Hat Enterprise Linux 7 Client is installed" test_ref="oval:com.redhat.rhsa:tst:20140675001"/>
120+
<criterion comment="Red Hat Enterprise Linux 7 Server is installed" test_ref="oval:com.redhat.rhsa:tst:20140675002"/>
121+
</criteria>
122+
<criteria operator="OR">
123+
<criteria operator="AND">
124+
<criterion comment="python is earlier than 0:2.7.5-77.el7_6" test_ref="oval:com.redhat.rhsa:tst:20190710005"/>
125+
<criterion comment="python is signed with Red Hat redhatrelease2 key" test_ref="oval:com.redhat.rhsa:tst:20152101006"/>
126+
</criteria>
127+
</criteria>
128+
</criteria>
129+
</definition>
130+
......
131+
<definition class="patch" id="" version="">
132+
</definition>
133+
</definitions>
134+
135+
<!-- tests是所有test的集合, oval规范了多种test模块, 这里只是其中的rpminfo模块 -->
136+
<tests>
137+
<red-def:rpminfo_test check="" comment="" id="" version="">
138+
</red-def:rpminfo_test>
139+
......
140+
<red-def:rpminfo_test check="" comment="" id="" version="">
141+
</red-def:rpminfo_test>
142+
</tests>
143+
144+
<!-- objects 是所有objects的集合, object表示从哪里获取什么数据 -->
145+
<objects>
146+
<red-def:rpminfo_object id="" version="">
147+
<red-def:name></red-def:name>
148+
</red-def:rpminfo_object>
149+
......
150+
<red-def:rpminfo_object id="" version="">
151+
<red-def:name></red-def:name>
152+
</red-def:rpminfo_object>
153+
</objects>
154+
155+
156+
<!-- states 是所有state的集合, state表示数据应该满足什么样的条件(等于/小于/正则匹配等) -->
157+
<states>
158+
<red-def:rpminfo_state id="" version="">
159+
<red-def:version operation="pattern match">^7[^\d]</red-def:version>
160+
</red-def:rpminfo_state>
161+
......
162+
<red-def:rpminfo_state id="" version="">
163+
<red-def:version operation="pattern match">^7[^\d]</red-def:version>
164+
</red-def:rpminfo_state>
165+
</states>
166+
167+
<!-- variables 是所有variable的集合, variables不是必须的, 可以在将值直接写在其他定义模块. -->
168+
<variables>
169+
<local_variable comment="" datatype="" id="" version="">
170+
</variables>
171+
172+
</oval_definitions>
173+
```
174+
175+
**OVAL解析结构**
176+
177+
![OVAL语法结构](_static/imgs/1569929995500.png)
178+
179+
可以看到OVAL单个文档都是非常模块化的, 模块化就会非常的灵活. 而且OVAL是严格校验的, 有很多点是需要注意的.
180+
181+
可以简单总结成公式:
182+
183+
```
184+
definition = test(object, state)
185+
```
186+
187+
**注意事项:**
188+
189+
1. oval是有版本要求的, oval扫描工具的要支持此oval语言的版本.
190+
191+
xml中generator:schema_version中定义了xml所需要的oval版本
192+
193+
![1569932892619](_static/imgs/1569932892619.png)
194+
195+
openscap中oval版本支持(向下兼容):
196+
197+
![1569932963220](_static/imgs/1569932963220.png)
198+
199+
2. 目前厂商提供的OVAL都指的是狭义的oval, 即系统补丁信息.
200+
201+
3. oval针对不同的系统, 规范了不同的probes, 也可以理解为test模块, 但是目前openscap仅仅实现了部分模块.
202+
203+
**osap on linux:**
204+
205+
![1569933572162](_static/imgs/1569933572162.png)
206+
207+
**oscap on windows:**
208+
209+
​ ![1569933601179](_static/imgs/1569933601179.png)
210+
211+
212+
213+
### OVAL 示例
214+
215+
OVAL都是非常庞大的, 如红帽提供给的针对redhat7的OVAL定义多达16w行, 分析起来非常晦涩难懂. 我摘取了其中一条检测规则, 简化成oval-demo示例,
216+
217+
参见: [com.redhat.rhsa-RHEL7-Demo.xml](https://github.com/Sep0lkit/Blog/tree/master/posts/_assets/oval-demo/com.redhat.rhsa-RHEL7-Demo.xml)
218+
219+
## OVAL 资源
220+
221+
目前主流的系统和软件提供商都提供oval仓库, 如:
222+
223+
- [Redhat](https://www.redhat.com/security/data/oval/)
224+
- [Ubuntu](https://people.canonical.com/~ubuntu-security/oval/)
225+
- [Debian](https://www.debian.org/security/oval/)
226+
- [Oracle Linux](https://linux.oracle.com/security/oval/)
227+
- [SUSE](http://ftp.suse.com/pub/projects/security/oval/)
228+
229+
## 其他:
230+
231+
- 不说oval这个标准落地的效果, 这个规范标准的思想是值得我们去学习和借鉴的
232+
- redhat开源一哥的地位真不是吹出来的, 对比其他家的oval你就知道redhat比他们强的不是一点.
233+
- redhat会校验软件包签名来降低误报率
234+
235+
**企业改如何使用OVAL:**
236+
237+
- 如果你自研发相关产品, OVAL是非常好的系统漏洞威胁情报源
238+
- 如果你没有强大的研发能力, 可以应用openscap, 自定义oval文档.
239+
- 你也可以通过ansible/hids等系统, 对系统进行资产漏洞评估.
240+
241+
openscap使用oval请参考前文: 安全自动化协议(SCAP)-资产漏洞评估示例
242+
243+
244+
245+
**广告:**
246+
247+
centos虽然基于redhat, 但是redhat的oval是无法在centos上使用的, 如果你的企业大部分都是使用centos, 可以考虑使用我转化后的oval: https://github.com/Sep0lkit/oval-for-el

‎posts/_assets/oval-demo/com.redhat.rhsa-RHEL7-Demo.xml

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:red-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux" xmlns:unix-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#unix unix-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#linux linux-definitions-schema.xsd">
3+
<generator>
4+
<oval:product_name>Red Hat OVAL Patch Definition Merger</oval:product_name>
5+
<oval:product_version>3</oval:product_version>
6+
<oval:schema_version>5.10</oval:schema_version>
7+
<oval:timestamp>2019-04-17T19:15:37</oval:timestamp>
8+
<oval:content_version>1555528537</oval:content_version>
9+
</generator>
10+
<definitions>
11+
<definition class="patch" id="oval:com.redhat.rhsa:def:20190710" version="602">
12+
<metadata>
13+
<title>RHSA-2019:0710: python security update (Important)</title>
14+
<affected family="unix">
15+
<platform>Red Hat Enterprise Linux 7</platform>
16+
</affected>
17+
<reference ref_id="RHSA-2019:0710-01" ref_url="https://access.redhat.com/errata/RHSA-2019:0710" source="RHSA"/>
18+
<reference ref_id="CVE-2019-9636" ref_url="https://access.redhat.com/security/cve/CVE-2019-9636" source="CVE"/>
19+
<description>Python is an interpreted, interactive, object-oriented programming language,</description>
20+
<advisory from="secalert@redhat.com">
21+
<severity>Important</severity>
22+
<rights>Copyright 2019 Red Hat, Inc.</rights>
23+
<issued date="2019-04-08"/>
24+
<updated date="2019-04-08"/>
25+
<cve cvss3="9.8/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" cwe="CWE-172" href="https://access.redhat.com/security/cve/CVE-2019-9636" public="20190306">CVE-2019-9636</cve>
26+
<bugzilla href="https://bugzilla.redhat.com/1688543" id="1688543">CVE-2019-9636 python: Information Disclosure due to urlsplit improper NFKC normalization</bugzilla>
27+
<affected_cpe_list>
28+
<cpe>cpe:/o:redhat:enterprise_linux:7</cpe>
29+
</affected_cpe_list>
30+
</advisory>
31+
</metadata>
32+
<criteria operator="AND">
33+
<criteria operator="OR">
34+
<criterion comment="Red Hat Enterprise Linux 7 Client is installed" test_ref="oval:com.redhat.rhsa:tst:20140675001"/>
35+
<criterion comment="Red Hat Enterprise Linux 7 Server is installed" test_ref="oval:com.redhat.rhsa:tst:20140675002"/>
36+
</criteria>
37+
<criteria operator="OR">
38+
<criteria operator="AND">
39+
<criterion comment="python is earlier than 0:2.7.5-77.el7_6" test_ref="oval:com.redhat.rhsa:tst:20190710005"/>
40+
<criterion comment="python is signed with Red Hat redhatrelease2 key" test_ref="oval:com.redhat.rhsa:tst:20152101006"/>
41+
</criteria>
42+
</criteria>
43+
</criteria>
44+
</definition>
45+
</definitions>
46+
<tests>
47+
<red-def:rpminfo_test check="at least one" comment="Red Hat Enterprise Linux 7 Client is installed" id="oval:com.redhat.rhsa:tst:20140675001" version="602">
48+
<red-def:object object_ref="oval:com.redhat.rhsa:obj:20140675001"/>
49+
<red-def:state state_ref="oval:com.redhat.rhsa:ste:20140675002"/>
50+
</red-def:rpminfo_test>
51+
<red-def:rpminfo_test check="at least one" comment="Red Hat Enterprise Linux 7 Server is installed" id="oval:com.redhat.rhsa:tst:20140675002" version="602">
52+
<red-def:object object_ref="oval:com.redhat.rhsa:obj:20140675002"/>
53+
<red-def:state state_ref="oval:com.redhat.rhsa:ste:20140675002"/>
54+
</red-def:rpminfo_test>
55+
<red-def:rpminfo_test check="at least one" comment="python is earlier than 0:2.7.5-77.el7_6" id="oval:com.redhat.rhsa:tst:20190710005" version="602">
56+
<red-def:object object_ref="oval:com.redhat.rhsa:obj:20152101005"/>
57+
<red-def:state state_ref="oval:com.redhat.rhsa:ste:20190710003"/>
58+
</red-def:rpminfo_test>
59+
<red-def:rpminfo_test check="at least one" comment="python is signed with Red Hat redhatrelease2 key" id="oval:com.redhat.rhsa:tst:20152101006" version="604">
60+
<red-def:object object_ref="oval:com.redhat.rhsa:obj:20152101005"/>
61+
<red-def:state state_ref="oval:com.redhat.rhsa:ste:20140675001"/>
62+
</red-def:rpminfo_test>
63+
</tests>
64+
<objects>
65+
<red-def:rpminfo_object id="oval:com.redhat.rhsa:obj:20140675001" version="602">
66+
<red-def:name>redhat-release-client</red-def:name>
67+
</red-def:rpminfo_object>
68+
<red-def:rpminfo_object id="oval:com.redhat.rhsa:obj:20140675002" version="602">
69+
<red-def:name>redhat-release-server</red-def:name>
70+
</red-def:rpminfo_object>
71+
<red-def:rpminfo_object id="oval:com.redhat.rhsa:obj:20152101005" version="604">
72+
<red-def:name>python</red-def:name>
73+
</red-def:rpminfo_object>
74+
</objects>
75+
<states>
76+
<red-def:rpminfo_state id="oval:com.redhat.rhsa:ste:20140675002" version="602">
77+
<red-def:version operation="pattern match">^7[^\d]</red-def:version>
78+
</red-def:rpminfo_state>
79+
<red-def:rpminfo_state id="oval:com.redhat.rhsa:ste:20190710003" version="602">
80+
<red-def:arch datatype="string" operation="pattern match">aarch64|ppc64|ppc64le|s390x|x86_64</red-def:arch>
81+
<red-def:evr datatype="evr_string" operation="less than">0:2.7.5-77.el7_6</red-def:evr>
82+
</red-def:rpminfo_state>
83+
<red-def:rpminfo_state id="oval:com.redhat.rhsa:ste:20140675001" version="602">
84+
<red-def:signature_keyid operation="equals">199e2f91fd431d51</red-def:signature_keyid>
85+
</red-def:rpminfo_state>
86+
</states>
87+
</oval_definitions>

‎posts/_static/imgs/1569929995500.png

24.8 KB
Loading

‎posts/_static/imgs/1569932892619.png

5.18 KB
Loading

‎posts/_static/imgs/1569932963220.png

16.7 KB
Loading

‎posts/_static/imgs/1569933572162.png

46.2 KB
Loading

‎posts/_static/imgs/1569933601179.png

10.2 KB
Loading

‎posts/phpstudy后门应急与检测.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# phpstudy漏洞应急与检测
1+
# phpstudy后门应急与检测
22

33

44

0 commit comments

Comments
 (0)