Open Vulnerability and Assessment Language

I

INSTALLATION

A.

Red Hat Linux

Install the RPM simply by running the following command:

# rpm -ivh <Definition Interpreter RPM>

The RPM places the following files on the system. To learn their exact location after install, run: rpm -ql ovaldi.

Executables:
ovaldi.sh - Shell Script to simplify execution of the Definition
Interpreter
ovaldi - Definition Interpreter binary

Libraries:
libxerces-c.so.27.0 - Xerces XML library
libxalan-c.so.110.0 - Xalan XSL library
libxalanMsg.so.110.0 - Xalan Message library
libpcre.so.0.0.1 - PCRE Regular Expression library

Documentation:
README.txt - This file
terms.txt - License and Terms of Use
version.txt - OVAL Interpreter change log

XML:
linux.definitions.xml - A set of sample OVAL definitions
(See "Obtaining Updated Data Files" below)

XML Schema:
OVAL schema files
xmldsig-core-schema.xsd - XML digital signature schema

The .so file for the Xerces library must be made accessible to the Definition Interpreter binary. The ovaldi RPM places a pre-compiled version in /usr/lib/ovaldi/ and appends this directory to your /etc/ld.so.conf file.

To run the Definition Interpreter, run:

# /usr/sbin/ovaldi.sh

A result summary will be output to the screen, and detailed System Characteristic and Output Results will be output to /var/log/ovaldi.

B.

Sun Solaris

C.

Microsoft Windows

Install the Interpreter by running the installer
executable - ovaldisetupX.X.exe

The installer is a self-extracting zip archive that prompts the user for an installation directory ('C:\Program Files\OVAL\ovaldi\' by default) and installs the Interpreter and its supporting files.

Executables:
ovaldi.exe - OVAL Interpreter binary

Libraries:
xerces-c_2_7_0.dll - Xerces XML library
msvcr71.dll - Microsoft C Runtime Library
pcre.dll - Perl-compatible regular-expression library
Xalan-C_1_10.dll - Xalan XSLT library
XalanMessages_1_10.dll - Xalan XSLT library

Documentation:
README.txt - This file
terms.txt - License and Terms of Use
version.txt - Definition Interpreter change log

XML:
windows.definitions.xml - A set of sample OVAL definitions
(See "Obtaining Updated Data Files" below)

XML Schema:
OVAL schema files
xmldsig-core-schema.xsd - XML digital signature schema

II

USING THE INTERPRETER

A.

Required Privileges

Certain system data referenced by OVAL Definitions is only available to privileged accounts. This includes information about running processes, and potentially registry key and file information (depending on local security settings). While it is possible to run the OVAL Interpreter as a non-privileged user, the results of the analysis may not convey the true state of the system.

B.

Data Protection

C.

Obtaining Updated Data Files

Data files page:
http://oval.mitre.org/repository/download/index.html

Additionally it is recommended that you join the"OVAL-DATA-UPDATE" email list. This list provides subscribers with reports of new OVAL definitions, updates, and other detailed technical information regarding OVAL. This list is intended for heavy technical users of OVAL, such as tool and service developers, vulnerability database maintainers, or those who require timely notification of new definitions. Messages are sent when new OVAL data is available, which is approximately once per week. To subscribe to the list, go to the Free Newsletters page on the OVAL Web Site.

http://oval.mitre.org/community/registration.html

D.

Quick Usage Guide

2) If you have downloaded a newer data file than the one bundled with the Interpreter, move the new data file into the Interpreter installation directory, and rename it to 'definitions.xml'.

3) Run the Interpreter, supplying the MD5 checksum of the data file as a command line option.

> ovaldi MD5Hash

After verifying the integrity of the data file using the MD5 checksum, the OVAL Interpreter will read the 'definitions.xml' file to determine what data to collect from the system, will analyze the collected data against the 'definitions.xml' file, and will report its findings.

E.

Advanced Usage

Command Line: ovaldi [options] MD5Hash

Options:
-d filename = Save collected system configuration data to XML file.
DEFAULT="system-characteristics.xml"
-h = Show options available from the command line.
-i filename = Use data from input Systems Characteristics file.
-m = Do not verify MD5 of the definitions xml file.
-o filename = Path to the definitions xml file.
DEFAULT="definitions.xml"
-r filename = Save results to XMl file. DEFAULT="results.xml"
-p = Print all information and error messages to screen.
-z = Return md5 of current definitions xml file.

In more detail:
-d -- Specifies the pathname of the file to which collected configuration data is to be saved. This data is stored in the format defined by the Systems Characteristics Schema.

-h -- Displays command line options.

-i -- Specifies the pathname of a System Characteristics file that is to be used as the basis of the analysis. In this mode, the Interpreter does not perform data collection on the local system, but relies upon the input file, which may have been generated on another system.

-m -- Run without requiring an MD5 checksum. Running the Interpreter with this option DISABLES an important security feature. In normal usage, a trusted checksum provided on the command line is used to verify the integrity of the OVAL Definitions file.

Use of this option is recommended only when testing your own draft definitions before submitting them to the OVAL Community Forum for public review.

-o -- Specifies the pathname of the OVAL Definition file to use. If none is specified than the Interpreter will default to "definitions.xml" in the Interpreter directory.

-r -- Specifies the pathname of the file to which analysis results are to be saved. This data is stored according to the format defined by the OVAL Results Schema. If none is specified than the Interpreter will default to "results.xml" in the Interpreter directory.

-p -- Verbose output. Print all information and error message to the console.

-z -- Calculates and prints to the screen the MD5 checksum of the current data file (definitions.xml by default, or as specified by the -o option). This can be used to manually compare the current file with the trusted checksum available from the OVAL Web site.

MD5Hash -- The MD5 checksum expected for the current data file (definitions.xml by default, or as specified by the -o option). The Interpreter calculates the actual checksum of the Data file, and compares it to this value provided on the command line, to verify the data file's integrity. Checksums are available from the OVAL Web site.

The checksum verification ensures that the data file has not been modified: that the OVAL definitions have not been tampered with, or potentially malicious content added. Unless the -m option is specified, the MD5Hash is REQUIRED to run the Interpreter.

III

INPUT AND OUTPUT

A.

Input

If the data model is provided at runtime, the only requirement is that it be formatted according to the System Characteristics Schema. The data can be gathered using a tool other than the OVAL Interpreter, on another system, running a different operating system, but as long as the data is in the correct format, analysis can be performed. What this means is, not only can one system be used to run the analysis for a number of systems, but data models can be altered/fabricated to conduct 'what-if' scenarios.

B.

Output

The OVAL Results Schema is provided to allow the results of an analysis to be utilized by other applications. For example, an application could convert the detailed results to HTML for display on a Web site, or use the detailed results to determine what if any patches should be applied to a system. As mentioned above, the -r command line option may be used to redirect the output to a location other than the default.

IV

PCRE

"Regular expression support is provided by the PCRE library package, which is open source software, written by Philip Hazel, and copyright by the University of Cambridge, England."

For more information about PCRE visit:
http://www.pcre.org

To download the source code for PCRE, please use the following ftp site:
ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/

V

XERCES

"This product includes software developed by the Apache Software Foundation (http://www.apache.org/)."

For more information about Xerces visit:
http://xerces.apache.org/

The source code is also available at the above Web site.

VI

XALAN

"This product includes software developed by the Apache Software Foundation (http://www.apache.org/)."

For more information about Xalan visit:
http://xalan.apache.org/

The source code is also available at the above Web site.

VII

TROUBLESHOOTING

Q:

I am trying to run the OVAL Interpreter but all I get is a message saying "You must supply the MD5 hash for the data file or use the -m command to skip the MD5 check."

A:

The OVAL Interpreter is set up to validate that the Data file has not been tampered with by checking the MD5 hash (or checksum) generated from the data file on your computer with an MD5 hash provided by MITRE on the OVAL Web site. In order to start the OVAL Interpreter you must provide this MD5 hash. From the command line, type the program name 'ovaldi.exe' then add a space and type the MD5 hash value from the OVAL Web site. For example:

ovaldi.exe 897237212305b2d7a4dd5fa6b4e226fc

If you want to use some of the advanced option flags, place them between the program name and the MD5 hash. For example:

ovaldi.exe -i myData.xml -s 897237212305b2d7a4dd5fa6b4e226fc

If you do not want to supply the MD5 hash and are confident that the Data file on your computer has not been tampered with, you can supply the -m flag to skip the MD5 check. For example:

ovaldi.exe -m

Be careful when using the -m option. A data file that has been tampered with can cause misleading results to be generated. MITRE recommends that you always supply a valid MD5 hash from the OVAL Web site when using the OVAL Interpreter.

***********************************
Q:

I ran the OVAL Interpreter with the -p flag and I got a bunch of errors. Should I worry about them? The program seemed to run fine.

A:

Most of the messages produced when the -p flag is set are the result of registry keys and files not existing on your system. This kind of message is informational, rather than an error. In more detail:

An OVAL Definition may have tests to retrieve information about specified objects (files, registry keys, etc). On some systems, these objects simply do not exist, perhaps because a particular application or software component is not installed.

For example, installed patches are determined by the existence of certain registry keys. If a patch is not installed, then the registry key will not exist. When the Interpreter evaluates an OVAL definition, it attempts to collect information about this registry key on the system. If the key is not found, the patch is not installed. Since these missing objects are not really errors, they are not normally reported to the user, but appear when the -v option is specified.

Scan through the list of messages produced by the -p flag and look for errors that are not common. These could signify something that is working incorrectly.

VIII

REPORTING PROBLEMS

IX

USEFUL LINKS

OVAL Interpreters -- http://oval.mitre.org/language/download/interpreter/index.html

Data Files -- http://oval.mitre.org/repository/download/index.html

Terms of Use -- http://oval.mitre.org/about/bsd_license.html

CVE List -- http://cve.mitre.org

OVAL-Data-Updates e-Newsletter -- http://oval.mitre.org/news/newsletters.html