<?xml version="1.0" encoding="UTF-8"?>
<oval_definitions xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#windows windows-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5">
  <generator>
    <oval:product_name>The OVAL Repository</oval:product_name>
    <oval:schema_version>5.5</oval:schema_version>
    <oval:timestamp>2013-06-24T06:40:08.131-04:00</oval:timestamp>
  </generator>
  <definitions>
    <definition id="oval:org.mitre.oval:def:16847" version="1" class="vulnerability">
      <metadata>
        <title>Kernel Information Disclosure Vulnerability - MS13-048</title>
        <affected family="windows">
          <platform>Microsoft Windows 7</platform>
          <platform>Microsoft Windows Server 2003</platform>
          <platform>Microsoft Windows Server 2008</platform>
          <platform>Microsoft Windows Server 8</platform>
          <platform>Microsoft Windows Vista</platform>
          <platform>Microsoft Windows XP</platform>
        </affected>
        <reference source="CVE" ref_id="CVE-2013-3136" ref_url="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3136"/>
        <description>The kernel in Microsoft Windows XP SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 on 32-bit platforms does not properly handle unspecified page-fault system calls, which allows local users to obtain sensitive information from kernel memory via a crafted application, aka "Kernel Information Disclosure Vulnerability."</description>
        <oval_repository>
          <dates>
            <submitted date="2013-06-13T17:15:43">
              <contributor organization="SecPod Technologies">SecPod Team</contributor>
            </submitted>
            <status_change date="2013-06-13T14:08:49.371-04:00">DRAFT</status_change>
          </dates>
          <status>DRAFT</status>
        </oval_repository>
      </metadata>
      <criteria operator="OR">
        <criteria operator="AND" comment="XP x86 and vulnerable file version">
          <extend_definition comment="Microsoft Windows XP (x86) SP3 is installed" definition_ref="oval:org.mitre.oval:def:5631"/>
          <criterion comment="Check if the version of Ntoskrnl.exe is less than 5.1.2600.6387" test_ref="oval:org.mitre.oval:tst:81177"/>
        </criteria>
        <criteria operator="AND" comment="Server 2003 x86 and vulnerable file version">
          <extend_definition comment="Microsoft Windows Server 2003 SP2 (x86) is installed" definition_ref="oval:org.mitre.oval:def:1935"/>
          <criterion comment="Check if the version of Ntoskrnl.exe is less than 5.2.3790.5157" test_ref="oval:org.mitre.oval:tst:80294"/>
        </criteria>
        <criteria operator="AND" comment="Vista / 2K8 x86 and vulnerable file version">
          <criteria operator="OR" comment="Vista / 2K8">
            <extend_definition comment="Microsoft Windows Vista (32-bit) Service Pack 2 is installed" definition_ref="oval:org.mitre.oval:def:6124"/>
            <extend_definition comment="Microsoft Windows Server 2008 (32-bit) Service Pack 2 is installed" definition_ref="oval:org.mitre.oval:def:5653"/>
          </criteria>
          <criteria operator="OR" comment="Check for vulnerable version">
            <criterion comment="Check if the version of Ntoskrnl.exe is less than 6.0.6002.18832" test_ref="oval:org.mitre.oval:tst:80871"/>
            <criteria operator="AND" comment="Check for LDR range">
              <criterion comment="Check if the version of Ntoskrnl.exe is greater than or equal to 6.0.6002.23000" test_ref="oval:org.mitre.oval:tst:80719"/>
              <criterion comment="Check if the version of Ntoskrnl.exe is less than 6.0.6002.23103" test_ref="oval:org.mitre.oval:tst:81140"/>
            </criteria>
          </criteria>
        </criteria>
        <criteria operator="AND" comment="Win 7 x86 vulnerable file version">
          <extend_definition comment="Microsoft Windows 7 (32-bit) Service Pack 1 is installed" definition_ref="oval:org.mitre.oval:def:12292"/>
          <criteria operator="OR" comment="Check for vulnerable version">
            <criterion comment="Check if the version of Ntoskrnl.exe is less than 6.1.7601.18147" test_ref="oval:org.mitre.oval:tst:80675"/>
            <criteria operator="AND" comment="Check for LDR">
              <criterion comment="Check if the version of Ntoskrnl.exe is greater than or equal to 6.1.7601.22000" test_ref="oval:org.mitre.oval:tst:81000"/>
              <criterion comment="Check if the version of Ntoskrnl.exe is less than 6.1.7601.22318" test_ref="oval:org.mitre.oval:tst:80863"/>
            </criteria>
          </criteria>
        </criteria>
        <criteria operator="AND" comment="Win 8 x86 and vulnerable file version">
          <extend_definition comment="Microsoft Windows 8 (x86) is installed" definition_ref="oval:org.mitre.oval:def:14914"/>
          <criteria operator="OR" comment="Check for vulnerable version">
            <criterion comment="Check if the version of Ntoskrnl.exe is less than 6.2.9200.16604" test_ref="oval:org.mitre.oval:tst:80789"/>
            <criteria operator="AND" comment="Check for LDR">
              <criterion comment="Check if the version of Ntoskrnl.exe is greater than or equal to 6.2.9200.20000" test_ref="oval:org.mitre.oval:tst:80722"/>
              <criterion comment="Check if the version of Ntoskrnl.exe is less than 6.2.9200.20708" test_ref="oval:org.mitre.oval:tst:81243"/>
            </criteria>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:org.mitre.oval:def:6124" version="7" class="inventory">
      <metadata>
        <title>Microsoft Windows Vista (32-bit) Service Pack 2 is installed</title>
        <affected family="windows">
          <platform>Microsoft Windows Vista</platform>
        </affected>
        <reference source="CPE" ref_id="cpe:/o:microsoft:windows_vista::sp2:x86"/>
        <description>The operating system installed on the system is Microsoft Windows Vista (32-bit) Service Pack 2</description>
        <oval_repository>
          <dates>
            <submitted date="2009-05-04T16:00:00">
              <contributor organization="Gideon Technologies, Inc.">Dragos Prisaca</contributor>
            </submitted>
            <modified comment="Updated comment to include Vista and Server 2008" date="2009-05-07T10:32:00.713-04:00">
              <contributor organization="Gideon Technologies, Inc.">Dragos Prisaca</contributor>
            </modified>
            <status_change date="2009-05-07T11:17:28.873-04:00">DRAFT</status_change>
            <status_change date="2009-05-25T04:02:00.040-04:00">INTERIM</status_change>
            <status_change date="2009-06-22T04:00:28.642-04:00">ACCEPTED</status_change>
            <modified comment="Changed registry check for amd64 to be a case insensitive equals" date="2009-09-04T10:48:00.140-05:00">
              <contributor organization="Hewlett-Packard">Todd Dolinsky</contributor>
            </modified>
            <status_change date="2009-09-07T04:00:27.692-04:00">INTERIM</status_change>
            <status_change date="2009-09-28T04:00:15.275-04:00">ACCEPTED</status_change>
            <modified comment="Replaced negation of test for x64 with a case insensitive test for x86 and changed the tests for SP2, Vista, and windows to be case insensitive" date="2009-12-02T16:05:00.749-04:00">
              <contributor organization="National Institute of Standards and Technology">Tim Harrison</contributor>
            </modified>
            <status_change date="2009-12-02T16:05:00.749-04:00">INTERIM</status_change>
            <modified comment="Added anchors and spaces to regular expression" date="2009-12-04T14:55:00.401-05:00">
              <contributor organization="National Institute of Standards and Technology">Tim Harrison</contributor>
            </modified>
            <modified comment="Updating regex to include parenthesis" date="2009-12-08T17:31:00.669-05:00">
              <contributor organization="National Institute of Standards and Technology">Tim Harrison</contributor>
            </modified>
            <status_change date="2010-01-04T04:01:42.790-05:00">ACCEPTED</status_change>
            <modified comment="EDITED oval:org.mitre.oval:obj:717 - Added an additional test for Windows Server 2003 platforms to test for the existence of the NT Directory Services" date="2011-04-25T14:34:00.432-04:00">
              <contributor organization="Telos">Sudhir Gandhe</contributor>
            </modified>
            <status_change date="2011-04-25T14:44:31.595-04:00">INTERIM</status_change>
            <modified comment="EDITED oval:org.mitre.oval:obj:717 - Reverted mistaken switch of obj:717 (Service Pack) and obj:15869 (NT Directory Services)" date="2011-04-26T11:53:00.464-04:00">
              <contributor organization="G2, Inc.">Shane Shaffer</contributor>
            </modified>
            <status_change date="2011-05-16T04:03:16.527-04:00">ACCEPTED</status_change>
          </dates>
          <status>ACCEPTED</status>
        </oval_repository>
      </metadata>
      <criteria>
        <criterion comment="the installed operating system is part of the Microsoft Windows family" test_ref="oval:org.mitre.oval:tst:99"/>
        <criterion comment="Windows Vista is installed" test_ref="oval:org.mitre.oval:tst:7914"/>
        <criterion comment="a version of Windows for the x86 architecture is installed" test_ref="oval:org.mitre.oval:tst:3823"/>
        <criterion comment="Win2K/XP/2003/Vista/2008 service pack 2 is installed" test_ref="oval:org.mitre.oval:tst:3019"/>
      </criteria>
    </definition>
    <definition id="oval:org.mitre.oval:def:5653" version="9" class="inventory">
      <metadata>
        <title>Microsoft Windows Server 2008 (32-bit) Service Pack 2 is installed</title>
        <affected family="windows">
          <platform>Microsoft Windows Server 2008</platform>
        </affected>
        <reference source="CPE" ref_id="cpe:/o:microsoft:windows_server_2008::sp2:x86"/>
        <description>The operating system installed on the system is Microsoft Windows Server 2008 (32-bit) Service Pack 2</description>
        <oval_repository>
          <dates>
            <submitted date="2009-05-04T16:00:00">
              <contributor organization="Gideon Technologies, Inc.">Dragos Prisaca</contributor>
            </submitted>
            <status_change date="2009-05-07T11:17:37.121-04:00">DRAFT</status_change>
            <status_change date="2009-05-25T04:01:42.700-04:00">INTERIM</status_change>
            <status_change date="2009-06-22T04:00:24.249-04:00">ACCEPTED</status_change>
            <modified comment="Changed registry check for amd64 to be a case insensitive equals" date="2009-09-04T10:48:00.140-05:00">
              <contributor organization="Hewlett-Packard">Todd Dolinsky</contributor>
            </modified>
            <status_change date="2009-09-07T04:00:26.467-04:00">INTERIM</status_change>
            <status_change date="2009-09-28T04:00:07.133-04:00">ACCEPTED</status_change>
            <modified comment="Replaced negation of test for x64 with a case insensitive test for x86, added a negated test for 2008 R2 and changed the tests for SP2 and windows to be case insensitive" date="2009-12-02T16:05:00.749-04:00">
              <contributor organization="National Institute of Standards and Technology">Tim Harrison</contributor>
            </modified>
            <status_change date="2009-12-02T16:05:00.749-04:00">INTERIM</status_change>
            <modified comment="Added anchors and spaces to regular expression" date="2009-12-04T14:54:00.233-05:00">
              <contributor organization="National Institute of Standards and Technology">Tim Harrison</contributor>
            </modified>
            <modified comment="Added anchors and spaces to regular expression" date="2009-12-04T14:56:00.439-05:00">
              <contributor organization="National Institute of Standards and Technology">Tim Harrison</contributor>
            </modified>
            <modified comment="Updating regex to include parenthesis" date="2009-12-08T17:32:00.144-05:00">
              <contributor organization="National Institute of Standards and Technology">Tim Harrison</contributor>
            </modified>
            <status_change date="2010-01-04T04:01:38.208-05:00">ACCEPTED</status_change>
            <modified comment="EDITED oval:org.mitre.oval:def:5653 - Corrected the CPE names for Windows Server 2008" date="2010-12-21T10:57:00.617-05:00">
              <contributor organization="The MITRE Corporation">Jonathan Baker</contributor>
            </modified>
            <status_change date="2010-12-21T11:00:21.376-05:00">INTERIM</status_change>
            <status_change date="2011-02-07T04:00:12.818-05:00">ACCEPTED</status_change>
            <modified comment="EDITED oval:org.mitre.oval:obj:717 - Added an additional test for Windows Server 2003 platforms to test for the existence of the NT Directory Services" date="2011-04-25T14:34:00.432-04:00">
              <contributor organization="Telos">Sudhir Gandhe</contributor>
            </modified>
            <status_change date="2011-04-25T14:45:40.947-04:00">INTERIM</status_change>
            <modified comment="EDITED oval:org.mitre.oval:obj:717 - Reverted mistaken switch of obj:717 (Service Pack) and obj:15869 (NT Directory Services)" date="2011-04-26T11:53:00.464-04:00">
              <contributor organization="G2, Inc.">Shane Shaffer</contributor>
            </modified>
            <status_change date="2011-05-16T04:03:12.167-04:00">ACCEPTED</status_change>
          </dates>
          <status>ACCEPTED</status>
        </oval_repository>
      </metadata>
      <criteria>
        <criterion comment="the installed operating system is part of the Microsoft Windows family" test_ref="oval:org.mitre.oval:tst:99"/>
        <criterion comment="Windows Server 2008 is installed" test_ref="oval:org.mitre.oval:tst:7697"/>
        <criterion comment="a version of Windows for the x86 architecture is installed" test_ref="oval:org.mitre.oval:tst:3823"/>
        <criterion comment="Win2K/XP/2003/Vista/2008 service pack 2 is installed" test_ref="oval:org.mitre.oval:tst:3019"/>
        <criterion negate="true" comment="Windows Server 2008 R2 is installed" test_ref="oval:org.mitre.oval:tst:10317"/>
      </criteria>
    </definition>
    <definition id="oval:org.mitre.oval:def:5631" version="6" class="inventory">
      <metadata>
        <title>Microsoft Windows XP (x86) SP3 is installed</title>
        <affected family="windows">
          <platform>Microsoft Windows XP</platform>
        </affected>
        <reference source="CPE" ref_id="cpe:/o:microsoft:windows_xp::sp3:x86"/>
        <description>A version of Microsoft Windows XP (x86) Service Pack 3 is installed.</description>
        <oval_repository>
          <dates>
            <submitted date="2008-06-10T14:50:00">
              <contributor organization="Secure Elements, Inc.">Sudhir Gandhe</contributor>
            </submitted>
            <status_change date="2008-06-12T13:58:47.155-04:00">DRAFT</status_change>
            <status_change date="2008-06-30T04:00:18.370-04:00">INTERIM</status_change>
            <status_change date="2008-07-21T04:00:18.901-04:00">ACCEPTED</status_change>
            <modified comment="Changed the tests for x86, SP3, and windows to be case insensitive and replaced the test for Windows 5.1 with a new test for Windows XP" date="2009-12-02T16:05:00.749-04:00">
              <contributor organization="National Institute of Standards and Technology">Tim Harrison</contributor>
            </modified>
            <status_change date="2009-12-02T16:05:00.749-04:00">INTERIM</status_change>
            <modified comment="Added anchors and spaces to regular expression" date="2009-12-04T14:56:00.359-05:00">
              <contributor organization="National Institute of Standards and Technology">Tim Harrison</contributor>
            </modified>
            <modified comment="Updating regex to include parenthesis" date="2009-12-08T17:32:00.792-05:00">
              <contributor organization="National Institute of Standards and Technology">Tim Harrison</contributor>
            </modified>
            <status_change date="2010-01-04T04:01:36.319-05:00">ACCEPTED</status_change>
            <modified comment="EDITED oval:org.mitre.oval:obj:717 - Added an additional test for Windows Server 2003 platforms to test for the existence of the NT Directory Services" date="2011-04-25T14:34:00.432-04:00">
              <contributor organization="Telos">Sudhir Gandhe</contributor>
            </modified>
            <status_change date="2011-04-25T14:44:36.981-04:00">INTERIM</status_change>
            <modified comment="EDITED oval:org.mitre.oval:obj:717 - Reverted mistaken switch of obj:717 (Service Pack) and obj:15869 (NT Directory Services)" date="2011-04-26T11:53:00.464-04:00">
              <contributor organization="G2, Inc.">Shane Shaffer</contributor>
            </modified>
            <status_change date="2011-05-16T04:03:11.414-04:00">ACCEPTED</status_change>
          </dates>
          <status>ACCEPTED</status>
        </oval_repository>
      </metadata>
      <criteria operator="AND">
        <criterion comment="the installed operating system is part of the Microsoft Windows family" test_ref="oval:org.mitre.oval:tst:99"/>
        <criterion comment="Windows XP is installed" test_ref="oval:org.mitre.oval:tst:11179"/>
        <criterion comment="a version of Windows for the x86 architecture is installed" test_ref="oval:org.mitre.oval:tst:3823"/>
        <criterion comment="Win2K/XP/2003 service pack 3 is installed" test_ref="oval:org.mitre.oval:tst:7814"/>
      </criteria>
    </definition>
    <definition id="oval:org.mitre.oval:def:1935" version="11" class="inventory">
      <metadata>
        <title>Microsoft Windows Server 2003 SP2 (x86) is installed</title>
        <affected family="windows">
          <platform>Microsoft Windows Server 2003</platform>
        </affected>
        <reference source="CPE" ref_id="cpe:/o:microsoft:windows_server_2003::sp2:x86"/>
        <description>A version of Microsoft Windows Server 2003 Service Pack 2 (x86) is installed.</description>
        <oval_repository>
          <dates>
            <submitted date="2007-04-09T09:49:32">
              <contributor organization="Secure Elements, Inc.">Sudhir Gandhe</contributor>
            </submitted>
            <status_change date="2007-04-09T11:20:00.000-05:00">DRAFT</status_change>
            <status_change date="2007-04-25T19:52:21.584-04:00">INTERIM</status_change>
            <modified comment="Dropped tst:4078 in favor of existing tst:3019." date="2007-04-26T13:47:00.955-04:00">
              <contributor organization="ThreatGuard, Inc.">Robert L. Hollis</contributor>
            </modified>
            <status_change date="2007-05-23T15:05:34.661-04:00">ACCEPTED</status_change>
            <modified comment="Changed the CPE reference" date="2008-04-04T11:17:00.742-04:00">
              <contributor organization="The MITRE Corporation">Andrew Buttner</contributor>
            </modified>
            <status_change date="2008-04-04T11:25:17.766-04:00">INTERIM</status_change>
            <status_change date="2008-04-21T04:00:15.390-04:00">ACCEPTED</status_change>
            <modified comment="Changed the tests for x86, SP2, and windows to be case insensitive and replaced the test for Windows 5.2 with a new test for 2003" date="2009-12-02T16:05:00.749-04:00">
              <contributor organization="National Institute of Standards and Technology">Tim Harrison</contributor>
            </modified>
            <status_change date="2009-12-02T16:05:00.749-04:00">INTERIM</status_change>
            <modified comment="Added anchors and spaces to regular expression" date="2009-12-04T14:56:00.085-05:00">
              <contributor organization="National Institute of Standards and Technology">Tim Harrison</contributor>
            </modified>
            <modified comment="Updating regex to include parenthesis" date="2009-12-08T17:31:00.354-05:00">
              <contributor organization="National Institute of Standards and Technology">Tim Harrison</contributor>
            </modified>
            <status_change date="2010-01-04T04:01:28.375-05:00">ACCEPTED</status_change>
            <modified comment="EDITED oval:org.mitre.oval:def:1935 - Updated Windows 2003 Server CPE names." date="2011-03-29T13:48:00.699-04:00">
              <contributor organization="G2, Inc.">Shane Shaffer</contributor>
            </modified>
            <status_change date="2011-03-29T13:51:28.652-04:00">INTERIM</status_change>
            <status_change date="2011-04-18T04:00:35.900-04:00">ACCEPTED</status_change>
            <modified comment="EDITED oval:org.mitre.oval:obj:717 - Added an additional test for Windows Server 2003 platforms to test for the existence of the NT Directory Services" date="2011-04-25T14:34:00.432-04:00">
              <contributor organization="Telos">Sudhir Gandhe</contributor>
            </modified>
            <status_change date="2011-04-25T14:44:01.374-04:00">INTERIM</status_change>
            <modified comment="EDITED oval:org.mitre.oval:obj:717 - Reverted mistaken switch of obj:717 (Service Pack) and obj:15869 (NT Directory Services)" date="2011-04-26T11:53:00.464-04:00">
              <contributor organization="G2, Inc.">Shane Shaffer</contributor>
            </modified>
            <status_change date="2011-05-16T04:02:08.090-04:00">ACCEPTED</status_change>
            <modified comment="EDITED oval:org.mitre.oval:def:1935 - Modifications vary from minor OVAL title/description changes to suggesting an alternative CPE name to use." date="2011-09-28T11:29:00.976-04:00">
              <contributor organization="The MITRE Corporation">David Rothenberg</contributor>
            </modified>
            <status_change date="2011-09-28T11:33:27.913-04:00">INTERIM</status_change>
            <status_change date="2011-10-17T04:00:14.602-04:00">ACCEPTED</status_change>
          </dates>
          <status>ACCEPTED</status>
        </oval_repository>
      </metadata>
      <criteria operator="AND">
        <criterion comment="the installed operating system is part of the Microsoft Windows family" test_ref="oval:org.mitre.oval:tst:99"/>
        <criterion comment="Windows Server 2003 is installed" test_ref="oval:org.mitre.oval:tst:11145"/>
        <criterion comment="a version of Windows for the x86 architecture is installed" test_ref="oval:org.mitre.oval:tst:3823"/>
        <criterion comment="Win2K/XP/2003/Vista/2008 service pack 2 is installed" test_ref="oval:org.mitre.oval:tst:3019"/>
      </criteria>
    </definition>
    <definition id="oval:org.mitre.oval:def:14914" version="3" class="inventory">
      <metadata>
        <title>Microsoft Windows 8 (x86) is installed</title>
        <affected family="windows">
          <platform>Microsoft Windows 8</platform>
        </affected>
        <reference source="CPE" ref_id="cpe:/o:microsoft:windows_8:::x86"/>
        <description>The operating system installed on the system is Microsoft Windows 8 x86</description>
        <oval_repository>
          <dates>
            <submitted date="2012-08-17T00:23:38.717-04:00">
              <contributor organization="G2, Inc.">Shane Shaffer</contributor>
            </submitted>
            <status_change date="2012-08-20T14:35:44.368-04:00">DRAFT</status_change>
            <status_change date="2012-09-10T04:00:09.870-04:00">INTERIM</status_change>
            <status_change date="2012-10-01T04:00:05.918-04:00">ACCEPTED</status_change>
          </dates>
          <status>ACCEPTED</status>
        </oval_repository>
      </metadata>
      <criteria>
        <criterion comment="the installed operating system is part of the Microsoft Windows family" test_ref="oval:org.mitre.oval:tst:99"/>
        <criterion comment="Windows 8 is installed" test_ref="oval:org.mitre.oval:tst:80065"/>
        <criterion comment="a version of Windows for the x86 architecture is installed" test_ref="oval:org.mitre.oval:tst:3823"/>
      </criteria>
    </definition>
    <definition id="oval:org.mitre.oval:def:12292" version="6" class="inventory">
      <metadata>
        <title>Microsoft Windows 7 (32-bit) Service Pack 1 is installed</title>
        <affected family="windows">
          <platform>Microsoft Windows 7</platform>
        </affected>
        <reference source="CPE" ref_id="cpe:/o:microsoft:windows_7::sp1:x86"/>
        <description>The operating system installed on the system is Microsoft Windows 7 (32-bit) Service Pack 1</description>
        <oval_repository>
          <dates>
            <submitted date="2011-02-23T11:42:00">
              <contributor organization="G2, Inc.">Shane Shaffer</contributor>
            </submitted>
            <status_change date="2011-02-28T09:34:48.696-05:00">DRAFT</status_change>
            <status_change date="2011-03-21T04:00:07.252-04:00">INTERIM</status_change>
            <modified comment="EDITED oval:org.mitre.oval:ste:12087 - Modified pattern match for ste:12087." date="2011-03-29T13:23:00.865-04:00">
              <contributor organization="SecPod Technologies">Chandan S</contributor>
            </modified>
            <status_change date="2011-04-18T04:00:16.014-04:00">ACCEPTED</status_change>
            <modified comment="EDITED oval:org.mitre.oval:ste:12087 - Updated comment for ste:12087" date="2011-05-04T09:09:00.463-04:00">
              <contributor organization="Secure Elements, Inc.">Dragos Prisaca</contributor>
            </modified>
            <status_change date="2011-05-04T09:14:35.212-04:00">INTERIM</status_change>
            <status_change date="2011-05-23T04:00:09.781-04:00">ACCEPTED</status_change>
          </dates>
          <status>ACCEPTED</status>
        </oval_repository>
      </metadata>
      <criteria>
        <criterion comment="the installed operating system is part of the Microsoft Windows family" test_ref="oval:org.mitre.oval:tst:99"/>
        <criterion comment="Windows 7 is installed" test_ref="oval:org.mitre.oval:tst:10792"/>
        <criterion comment="a version of Windows for the x86 architecture is installed" test_ref="oval:org.mitre.oval:tst:3823"/>
        <criterion comment="Service Pack 1 is installed" test_ref="oval:org.mitre.oval:tst:41933"/>
      </criteria>
    </definition>
  </definitions>
  <tests>
    <registry_test id="oval:org.mitre.oval:tst:7914" version="4" comment="Windows Vista is installed" check_existence="at_least_one_exists" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:5590"/>
      <state state_ref="oval:org.mitre.oval:ste:3828"/>
    </registry_test>
    <registry_test id="oval:org.mitre.oval:tst:7697" version="2" comment="Windows Server 2008 is installed" check_existence="at_least_one_exists" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:5590"/>
      <state state_ref="oval:org.mitre.oval:ste:3207"/>
    </registry_test>
    <registry_test id="oval:org.mitre.oval:tst:10317" version="4" comment="Windows Server 2008 R2 is installed" check_existence="at_least_one_exists" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:5590"/>
      <state state_ref="oval:org.mitre.oval:ste:5506"/>
    </registry_test>
    <registry_test id="oval:org.mitre.oval:tst:7814" version="4" comment="Win2K/XP/2003 service pack 3 is installed" check_existence="at_least_one_exists" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:717"/>
      <state state_ref="oval:org.mitre.oval:ste:3794"/>
    </registry_test>
    <registry_test id="oval:org.mitre.oval:tst:11179" version="3" comment="Windows XP is installed" check_existence="at_least_one_exists" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:5590"/>
      <state state_ref="oval:org.mitre.oval:ste:5477"/>
    </registry_test>
    <registry_test id="oval:org.mitre.oval:tst:3019" version="4" comment="Win2K/XP/2003/Vista/2008 service pack 2 is installed" check_existence="at_least_one_exists" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:717"/>
      <state state_ref="oval:org.mitre.oval:ste:2827"/>
    </registry_test>
    <registry_test id="oval:org.mitre.oval:tst:11145" version="3" comment="Windows Server 2003 is installed" check_existence="at_least_one_exists" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:5590"/>
      <state state_ref="oval:org.mitre.oval:ste:4907"/>
    </registry_test>
    <registry_test id="oval:org.mitre.oval:tst:80065" version="1" comment="Windows 8 is installed" check_existence="at_least_one_exists" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:5590"/>
      <state state_ref="oval:org.mitre.oval:ste:19981"/>
    </registry_test>
    <family_test id="oval:org.mitre.oval:tst:99" version="1" comment="the installed operating system is part of the Microsoft Windows family" check_existence="at_least_one_exists" check="only one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
      <object object_ref="oval:org.mitre.oval:obj:99"/>
      <state state_ref="oval:org.mitre.oval:ste:99"/>
    </family_test>
    <registry_test id="oval:org.mitre.oval:tst:41933" version="3" comment="Service Pack 1 is installed" check_existence="at_least_one_exists" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:15897"/>
      <state state_ref="oval:org.mitre.oval:ste:12087"/>
    </registry_test>
    <registry_test id="oval:org.mitre.oval:tst:3823" version="2" comment="a version of Windows for the x86 architecture is installed" check_existence="at_least_one_exists" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:1576"/>
      <state state_ref="oval:org.mitre.oval:ste:3649"/>
    </registry_test>
    <registry_test id="oval:org.mitre.oval:tst:10792" version="4" comment="Windows 7 is installed" check_existence="at_least_one_exists" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:5590"/>
      <state state_ref="oval:org.mitre.oval:ste:5027"/>
    </registry_test>
    <file_test id="oval:org.mitre.oval:tst:81243" version="1" comment="Check if the version of Ntoskrnl.exe is less than 6.2.9200.20708" check_existence="at_least_one_exists" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:335"/>
      <state state_ref="oval:org.mitre.oval:ste:20701"/>
    </file_test>
    <file_test id="oval:org.mitre.oval:tst:81177" version="1" comment="Check if the version of Ntoskrnl.exe is less than 5.1.2600.6387" check_existence="at_least_one_exists" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:335"/>
      <state state_ref="oval:org.mitre.oval:ste:20869"/>
    </file_test>
    <file_test id="oval:org.mitre.oval:tst:81140" version="1" comment="Check if the version of Ntoskrnl.exe is less than 6.0.6002.23103" check_existence="at_least_one_exists" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:335"/>
      <state state_ref="oval:org.mitre.oval:ste:20705"/>
    </file_test>
    <file_test id="oval:org.mitre.oval:tst:81000" version="1" comment="Check if the version of Ntoskrnl.exe is greater than or equal to 6.1.7601.22000" check_existence="at_least_one_exists" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:335"/>
      <state state_ref="oval:org.mitre.oval:ste:20456"/>
    </file_test>
    <file_test id="oval:org.mitre.oval:tst:80871" version="1" comment="Check if the version of Ntoskrnl.exe is less than 6.0.6002.18832" check_existence="at_least_one_exists" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:335"/>
      <state state_ref="oval:org.mitre.oval:ste:20818"/>
    </file_test>
    <file_test id="oval:org.mitre.oval:tst:80863" version="1" comment="Check if the version of Ntoskrnl.exe is less than 6.1.7601.22318" check_existence="at_least_one_exists" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:335"/>
      <state state_ref="oval:org.mitre.oval:ste:20155"/>
    </file_test>
    <file_test id="oval:org.mitre.oval:tst:80789" version="1" comment="Check if the version of Ntoskrnl.exe is less than 6.2.9200.16604" check_existence="at_least_one_exists" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:335"/>
      <state state_ref="oval:org.mitre.oval:ste:20713"/>
    </file_test>
    <file_test id="oval:org.mitre.oval:tst:80722" version="1" comment="Check if the version of Ntoskrnl.exe is greater than or equal to 6.2.9200.20000" check_existence="at_least_one_exists" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:335"/>
      <state state_ref="oval:org.mitre.oval:ste:20223"/>
    </file_test>
    <file_test id="oval:org.mitre.oval:tst:80719" version="1" comment="Check if the version of Ntoskrnl.exe is greater than or equal to 6.0.6002.23000" check_existence="at_least_one_exists" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:335"/>
      <state state_ref="oval:org.mitre.oval:ste:20865"/>
    </file_test>
    <file_test id="oval:org.mitre.oval:tst:80675" version="1" comment="Check if the version of Ntoskrnl.exe is less than 6.1.7601.18147" check_existence="at_least_one_exists" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:335"/>
      <state state_ref="oval:org.mitre.oval:ste:20838"/>
    </file_test>
    <file_test id="oval:org.mitre.oval:tst:80294" version="1" comment="Check if the version of Ntoskrnl.exe is less than 5.2.3790.5157" check_existence="at_least_one_exists" check="all" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:335"/>
      <state state_ref="oval:org.mitre.oval:ste:20755"/>
    </file_test>
  </tests>
  <objects>
    <registry_object id="oval:org.mitre.oval:obj:717" version="3" comment="This registry key holds the service pack installed on the host if one is present." xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <hive>HKEY_LOCAL_MACHINE</hive>
      <key>SOFTWARE\Microsoft\Windows NT\CurrentVersion</key>
      <name>CSDVersion</name>
    </registry_object>
    <family_object id="oval:org.mitre.oval:obj:99" version="1" comment="This is the default family object. Only one family object should exist." xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent"/>
    <registry_object id="oval:org.mitre.oval:obj:15897" version="1" comment="This registry key holds the BuildLab" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <hive>HKEY_LOCAL_MACHINE</hive>
      <key>SOFTWARE\Microsoft\Windows NT\CurrentVersion</key>
      <name>BuildLab</name>
    </registry_object>
    <registry_object id="oval:org.mitre.oval:obj:1576" version="1" comment="This registry key identifies the architecture on the system" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <hive>HKEY_LOCAL_MACHINE</hive>
      <key>SYSTEM\CurrentControlSet\Control\Session Manager\Environment</key>
      <name>PROCESSOR_ARCHITECTURE</name>
    </registry_object>
    <registry_object id="oval:org.mitre.oval:obj:5590" version="1" comment="This registry key identifies the Windows ProductName" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <hive>HKEY_LOCAL_MACHINE</hive>
      <key>SOFTWARE\Microsoft\Windows NT\CurrentVersion</key>
      <name>ProductName</name>
    </registry_object>
    <file_object id="oval:org.mitre.oval:obj:335" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <path var_ref="oval:org.mitre.oval:var:200" var_check="all"/>
      <filename>Ntoskrnl.exe</filename>
    </file_object>
    <registry_object id="oval:org.mitre.oval:obj:219" version="1" comment="This registry key identifies the system root." xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <hive>HKEY_LOCAL_MACHINE</hive>
      <key>SOFTWARE\Microsoft\Windows NT\CurrentVersion</key>
      <name>SystemRoot</name>
    </registry_object>
  </objects>
  <states>
    <registry_state id="oval:org.mitre.oval:ste:3828" version="4" comment="The registry key matches with Vista" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <value operation="pattern match">^[a-zA-Z0-9\(\)\s]*[Vv][Ii][Ss][Tt][Aa][a-zA-Z0-9\(\)\s]*$</value>
    </registry_state>
    <registry_state id="oval:org.mitre.oval:ste:3207" version="3" comment="The registry key matches with 2008" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <value operation="pattern match">^[a-zA-Z0-9\(\)\s]*2008[a-zA-Z0-9\(\)\s]*$</value>
    </registry_state>
    <registry_state id="oval:org.mitre.oval:ste:5506" version="4" comment="The registry key matches with 2008 R2" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <value operation="pattern match">^[a-zA-Z0-9\(\)\s]*2008 [Rr]2[a-zA-Z0-9\(\)\s]*$</value>
    </registry_state>
    <registry_state id="oval:org.mitre.oval:ste:3794" version="2" comment="The registry key has a value of Service Pack 3" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <value operation="case insensitive equals">Service Pack 3</value>
    </registry_state>
    <registry_state id="oval:org.mitre.oval:ste:5477" version="4" comment="The registry key matches with Windows XP" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <value operation="pattern match">^[a-zA-Z0-9\(\)\s]*[Ww][Ii][Nn][Dd][Oo][Ww][Ss] [Xx][Pp][a-zA-Z0-9\(\)\s]*$</value>
    </registry_state>
    <registry_state id="oval:org.mitre.oval:ste:2827" version="2" comment="The registry key has a value of Service Pack 2" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <value operation="case insensitive equals">Service Pack 2</value>
    </registry_state>
    <registry_state id="oval:org.mitre.oval:ste:4907" version="4" comment="The registry key matches with 2003" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <value operation="pattern match">^[a-zA-Z0-9\(\)\s]*2003[a-zA-Z0-9\(\)\s]*$</value>
    </registry_state>
    <registry_state id="oval:org.mitre.oval:ste:19981" version="1" comment="The registry key matches with Windows 8" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <value operation="pattern match">^[a-zA-Z0-9\(\)\s]*[Ww][Ii][Nn][Dd][Oo][Ww][Ss] 8[a-zA-Z0-9\(\)\s]*$</value>
    </registry_state>
    <family_state id="oval:org.mitre.oval:ste:99" version="2" comment="Microsoft Windows family" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
      <family operation="case insensitive equals">windows</family>
    </family_state>
    <registry_state id="oval:org.mitre.oval:ste:12087" version="3" comment="Value matches ^\d+\.win7sp1.*$" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <value operation="pattern match">^\d+\.win7sp1.*$</value>
    </registry_state>
    <registry_state id="oval:org.mitre.oval:ste:3649" version="2" comment="x86 architecture" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <value operation="case insensitive equals">x86</value>
    </registry_state>
    <registry_state id="oval:org.mitre.oval:ste:5027" version="4" comment="The registry key matches with Windows 7" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <value operation="pattern match">^[a-zA-Z0-9\(\)\s]*[Ww][Ii][Nn][Dd][Oo][Ww][Ss] 7[a-zA-Z0-9\(\)\s]*$</value>
    </registry_state>
    <file_state id="oval:org.mitre.oval:ste:20701" version="1" comment="State holds if the version is less than 6.2.9200.20708" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <version datatype="version" operation="less than">6.2.9200.20708</version>
    </file_state>
    <file_state id="oval:org.mitre.oval:ste:20869" version="1" comment="State holds if the version is less than 5.1.2600.6387" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <version datatype="version" operation="less than">5.1.2600.6387</version>
    </file_state>
    <file_state id="oval:org.mitre.oval:ste:20705" version="1" comment="State holds if the version is less than 6.0.6002.23103" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <version datatype="version" operation="less than">6.0.6002.23103</version>
    </file_state>
    <file_state id="oval:org.mitre.oval:ste:20456" version="1" comment="State holds if the version is greater than or equal to 6.1.7601.22000" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <version datatype="version" operation="greater than or equal">6.1.7601.22000</version>
    </file_state>
    <file_state id="oval:org.mitre.oval:ste:20818" version="1" comment="State holds if the version is less than 6.0.6002.18832" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <version datatype="version" operation="less than">6.0.6002.18832</version>
    </file_state>
    <file_state id="oval:org.mitre.oval:ste:20155" version="1" comment="State holds if the version is less than 6.1.7601.22318" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <version datatype="version" operation="less than">6.1.7601.22318</version>
    </file_state>
    <file_state id="oval:org.mitre.oval:ste:20713" version="1" comment="State holds if the version is less than 6.2.9200.16604" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <version datatype="version" operation="less than">6.2.9200.16604</version>
    </file_state>
    <file_state id="oval:org.mitre.oval:ste:20223" version="1" comment="State matches if the version is greater than or equal to 6.2.9200.20000" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <version datatype="version" operation="greater than or equal">6.2.9200.20000</version>
    </file_state>
    <file_state id="oval:org.mitre.oval:ste:20865" version="1" comment="State holds if the version is greater than or equal to 6.0.6002.23000" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <version datatype="version" operation="greater than or equal">6.0.6002.23000</version>
    </file_state>
    <file_state id="oval:org.mitre.oval:ste:20838" version="1" comment="State holds if the version is less than 6.1.7601.18147" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <version datatype="version" operation="less than">6.1.7601.18147</version>
    </file_state>
    <file_state id="oval:org.mitre.oval:ste:20755" version="1" comment="State holds if the version is less than 5.2.3790.5157" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <version datatype="version" operation="less than">5.2.3790.5157</version>
    </file_state>
  </states>
  <variables>
    <local_variable id="oval:org.mitre.oval:var:200" version="1" comment="Windows System32 directory" datatype="string">
      <concat>
        <object_component item_field="value" object_ref="oval:org.mitre.oval:obj:219"/>
        <literal_component>\System32</literal_component>
      </concat>
    </local_variable>
  </variables>
</oval_definitions>