<?xml version="1.0" encoding="UTF-8"?>
<oval_definitions xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#windows windows-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5">
  <generator>
    <oval:product_name>The OVAL Repository</oval:product_name>
    <oval:schema_version>5.6</oval:schema_version>
    <oval:timestamp>2009-11-20T04:31:07.645-05:00</oval:timestamp>
  </generator>
  <definitions>
    <definition id="oval:org.mitre.oval:def:1024" version="4" class="compliance">
      <metadata>
        <title>NetBIOS Over TCP/IP  is enabled</title>
        <affected family="windows">
          <platform>Microsoft Windows 2000</platform>
          <product>NetBIOS</product>
        </affected>
        <description>** REJECT **  DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: None.  Reason: this candidate is solely about a configuration that does not directly introduce security vulnerabilities, so it is more appropriate to cover under the Common Configuration Enumeration (CCE).  Notes: the former description is: "A component service related to NETBIOS is running."</description>
        <oval_repository>
          <dates>
            <submitted date="2004-05-18T12:00:00.000-04:00">
              <contributor organization="The MITRE Corporation">Tiffany Bergeron</contributor>
            </submitted>
            <status_change date="2004-06-16T12:00:00.000-04:00">INTERIM</status_change>
            <status_change date="2004-06-30T12:00:00.000-04:00">ACCEPTED</status_change>
            <modified comment="Removed reference to test for nt 4.0 and add reference to nt 4.0 inventory definition." date="2008-02-28T12:48:00.621-04:00">
              <contributor organization="The MITRE Corporation">Jonathan Baker</contributor>
            </modified>
            <status_change date="2008-03-03T04:00:29.096-05:00">INTERIM</status_change>
            <status_change date="2008-03-24T04:00:10.585-04:00">ACCEPTED</status_change>
            <modified comment="Changed datatype from int to string" date="2008-06-18T11:37:00.537-04:00">
              <contributor organization="Hewlett-Packard">Jeff Cheng</contributor>
            </modified>
            <status_change date="2008-06-18T11:38:07.717-04:00">INTERIM</status_change>
            <modified comment="Changed datatype from int to string" date="2008-06-18T11:37:00.207-04:00">
              <contributor organization="Hewlett-Packard">Jeff Cheng</contributor>
            </modified>
            <modified comment="Changed datatype from int to string" date="2008-06-18T11:37:00.067-04:00">
              <contributor organization="Hewlett-Packard">Jeff Cheng</contributor>
            </modified>
            <modified comment="Updated the title and changed a registry key" date="2008-06-27T09:26:00.816-04:00">
              <contributor organization="Secure Elements, Inc.">Dragos Prisaca</contributor>
            </modified>
            <status_change date="2008-07-14T04:00:13.739-04:00">ACCEPTED</status_change>
            <modified comment="changed its class to &quot;compliance&quot; from &quot;vulnerability&quot; and removed the CVE reference for it" date="2008-08-11T10:52:00.942-04:00">
              <contributor organization="Hewlett-Packard">Nicholas Hansen</contributor>
            </modified>
            <status_change date="2008-08-11T10:52:56.958-04:00">INTERIM</status_change>
            <status_change date="2008-09-01T04:00:42.048-04:00">ACCEPTED</status_change>
          </dates>
          <status>ACCEPTED</status>
        </oval_repository>
      </metadata>
      <criteria operator="AND">
        <criteria operator="AND" comment="Software section">
          <criteria operator="OR" comment="Windows NT or 2000 Installed">
            <extend_definition comment="Microsoft Windows NT is installed" definition_ref="oval:org.mitre.oval:def:36"/>
            <criterion comment="Windows 2000 is installed" test_ref="oval:org.mitre.oval:tst:3085"/>
          </criteria>
        </criteria>
        <criteria operator="AND" comment="Configuration section">
          <criteria operator="AND" comment="NetBIOS enabled">
            <criterion comment="NetBIOS Bind not disabled" test_ref="oval:org.mitre.oval:tst:1306"/>
            <criterion comment="NetBIOS Export not disabled" test_ref="oval:org.mitre.oval:tst:1305"/>
            <criterion comment="NetBIOS Route not disabled" test_ref="oval:org.mitre.oval:tst:1304"/>
          </criteria>
        </criteria>
      </criteria>
    </definition>
    <definition id="oval:org.mitre.oval:def:36" version="4" class="inventory">
      <metadata>
        <title>Microsoft Windows NT is installed</title>
        <affected family="windows">
          <platform>Microsoft Windows NT</platform>
        </affected>
        <reference source="CPE" ref_id="cpe:/o:microsoft:windows_nt"/>
        <description>The operating system installed on the system is Microsoft Windows NT.</description>
        <oval_repository>
          <dates>
            <submitted date="2006-06-26T12:55:00.000-04:00">
              <contributor organization="The MITRE Corporation">Andrew Buttner</contributor>
            </submitted>
            <status_change date="2006-06-26T12:55:00.000-04:00">ACCEPTED</status_change>
            <modified comment="Added CPE reference." date="2007-04-30T07:48:00.621-04:00">
              <contributor organization="The MITRE Corporation">Jonathan Baker</contributor>
            </modified>
            <status_change date="2007-04-30T08:04:19.640-04:00">INTERIM</status_change>
            <status_change date="2007-05-23T15:05:44.870-04:00">ACCEPTED</status_change>
            <modified comment="Removed reference to test for nt 4.0 and add reference to nt 4.0 inventory definition." date="2008-02-28T12:48:00.621-04:00">
              <contributor organization="The MITRE Corporation">Jonathan Baker</contributor>
            </modified>
            <modified comment="Removed datatype attribute from the value element of the registry state." date="2008-02-28T14:05:00.268-05:00">
              <contributor organization="Hewlett-Packard">Jeff Cheng</contributor>
            </modified>
            <status_change date="2008-02-28T14:07:43.712-05:00">INTERIM</status_change>
            <status_change date="2008-03-17T04:00:20.911-04:00">ACCEPTED</status_change>
            <modified comment="Changed the CPE reference" date="2008-04-04T11:17:00.580-04:00">
              <contributor organization="The MITRE Corporation">Andrew Buttner</contributor>
            </modified>
            <status_change date="2008-04-04T11:26:38.604-04:00">INTERIM</status_change>
            <status_change date="2008-04-21T04:00:18.502-04:00">ACCEPTED</status_change>
          </dates>
          <status>ACCEPTED</status>
        </oval_repository>
      </metadata>
      <criteria operator="AND">
        <criterion comment="the installed operating system is part of the Microsoft Windows family" test_ref="oval:org.mitre.oval:tst:99"/>
        <criterion comment="Windows NT 4.0 is installed" test_ref="oval:org.mitre.oval:tst:3089"/>
      </criteria>
    </definition>
  </definitions>
  <tests>
    <family_test id="oval:org.mitre.oval:tst:99" version="1" comment="the installed operating system is part of the Microsoft Windows family" check_existence="at_least_one_exists" check="only one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
      <object object_ref="oval:org.mitre.oval:obj:99"/>
      <state state_ref="oval:org.mitre.oval:ste:99"/>
    </family_test>
    <registry_test id="oval:org.mitre.oval:tst:3089" version="2" comment="Windows NT 4.0 is installed" check_existence="at_least_one_exists" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:123"/>
      <state state_ref="oval:org.mitre.oval:ste:2894"/>
    </registry_test>
    <registry_test id="oval:org.mitre.oval:tst:3085" version="1" comment="Windows 2000 is installed" check_existence="at_least_one_exists" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:419"/>
      <state state_ref="oval:org.mitre.oval:ste:2890"/>
    </registry_test>
    <registry_test id="oval:org.mitre.oval:tst:1306" version="2" comment="NetBIOS Bind not disabled" check_existence="at_least_one_exists" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:906"/>
      <state state_ref="oval:org.mitre.oval:ste:1175"/>
    </registry_test>
    <registry_test id="oval:org.mitre.oval:tst:1305" version="2" comment="NetBIOS Export not disabled" check_existence="at_least_one_exists" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:905"/>
      <state state_ref="oval:org.mitre.oval:ste:1174"/>
    </registry_test>
    <registry_test id="oval:org.mitre.oval:tst:1304" version="2" comment="NetBIOS Route not disabled" check_existence="at_least_one_exists" check="at least one" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <object object_ref="oval:org.mitre.oval:obj:904"/>
      <state state_ref="oval:org.mitre.oval:ste:1173"/>
    </registry_test>
  </tests>
  <objects>
    <family_object id="oval:org.mitre.oval:obj:99" version="1" comment="This is the default family object. Only one family object should exist." xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent"/>
    <registry_object id="oval:org.mitre.oval:obj:123" version="1" comment="Registry key that hold the current windows os version" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <hive>HKEY_LOCAL_MACHINE</hive>
      <key>SOFTWARE\Microsoft\Windows NT\CurrentVersion</key>
      <name>CurrentVersion</name>
    </registry_object>
    <registry_object id="oval:org.mitre.oval:obj:419" version="1" comment="This registry key holds the version of the installed operating system." xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <hive>HKEY_LOCAL_MACHINE</hive>
      <key>SOFTWARE\Microsoft\Windows NT\CurrentVersion</key>
      <name>CurrentVersion</name>
    </registry_object>
    <registry_object id="oval:org.mitre.oval:obj:906" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <hive>HKEY_LOCAL_MACHINE</hive>
      <key>SYSTEM\CurrentControlSet\Services\NetBT\Linkage</key>
      <name>Bind</name>
    </registry_object>
    <registry_object id="oval:org.mitre.oval:obj:905" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <hive>HKEY_LOCAL_MACHINE</hive>
      <key>SYSTEM\CurrentControlSet\Services\NetBT\Linkage</key>
      <name>Export</name>
    </registry_object>
    <registry_object id="oval:org.mitre.oval:obj:904" version="1" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <hive>HKEY_LOCAL_MACHINE</hive>
      <key>SYSTEM\CurrentControlSet\Services\NetBT\Linkage</key>
      <name>Route</name>
    </registry_object>
  </objects>
  <states>
    <family_state id="oval:org.mitre.oval:ste:99" version="1" comment="Microsoft Windows family" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent">
      <family>windows</family>
    </family_state>
    <registry_state id="oval:org.mitre.oval:ste:2894" version="2" comment="Registry key has a value of 4.0" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <value>4.0</value>
    </registry_state>
    <registry_state id="oval:org.mitre.oval:ste:2890" version="1" comment="Registry key has a value of 5.0" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <value>5.0</value>
    </registry_state>
    <registry_state id="oval:org.mitre.oval:ste:1175" version="2" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <value operation="not equal">0</value>
    </registry_state>
    <registry_state id="oval:org.mitre.oval:ste:1174" version="2" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <value operation="not equal">0</value>
    </registry_state>
    <registry_state id="oval:org.mitre.oval:ste:1173" version="2" xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows">
      <value operation="not equal">0</value>
    </registry_state>
  </states>
</oval_definitions>