Open Vulnerability and Assessment Language

Version 5.10.1 (Archived)

This page provides information on the proposed changes to the OVAL Language. This is an update version change that fixes a critical issue discovered in Version 5.10 of the OVAL Language. All information about the new version is included in this centralized location. The major highlights of the release so far are listed below:

• Deprecated the include_group behavior in the win-def:sharedresourceeffectiverights_test and the win-def:sharedresourceauditedpermissions_test.
• Made several documentation clarifications and fixes.
• Updated the schema_version entity, in the GeneratorType, to align with the new three-component version identifier in the OVAL Language Versioning Policy.
• Updated the version entity, in the DeprecatedInfoType, to align with the new three-component version identifier in the OVAL Language Versioning Policy.
• Added the missing extended_name entity to the linux-def:rpmverifypackage_state.
• Changed the minOccurs attribute on the entities in the linux-def:rpmverifypackage_object and linux-def:rpmverifyfile_object from "0" to "1".

All of the above items remain open for discussion and any comments or feedback is greatly appreciated. For a complete listing of the release contents see the New in Version 5.10.1 section. More information about the OVAL Language review process can be found on the OVAL Language Review Process page.

Test Listing

A complete listing of the tests available in this release can be found on the Version 5.10.1 — Test Listing page.

Specifications

Please submit any comments or questions about the current versions of the OVAL Language Specification document(s) to oval-developer-list@lists.mitre.org. Along with any comments please specify the exact version of the document that is being commented on. Track changes has been enabled in the document and annotated documents are appreciated. If you would like to submit an annotated document please simply attach it to your email to the oval-developer-list. You may also submit comments directly to oval@mitre.org.

OVAL Language Specification:

• OVAL Language Specification 01-20-2012 (Word, 755 KB)
• OVAL Language Specification 01-20-2012 (PDF, 2.7 MB)

OVAL Language Component Model Specifications:

• OVAL Language Windows Component Data Model Specification 01-19-2012 (Word, 4.2 MB)
• OVAL Language Windows Component Data Model Specification 01-19-2012 (PDF, 1.4 MB)
• OVAL Language UNIX Component Data Model Specification 04-04-2012 (Word, 1.5 MB)
• OVAL Language UNIX Component Data Model Specification 04-04-2012 (PDF, 2.7 KB)

In addition, all currently available specifications associated with a particular schema are posted in the Specifications columns in the Downloads section, below.

Downloads

Includes downloads for the Version 5.10.1 Schemas, Specifications, Schematron Rules, Element Dictionaries, and Deprecation Listings.

New in Version 5.10.1

Version 5.10.1 of the Official OVAL Schema is a direct result of feedback from the OVAL Community. This will be an update version change and may require some new development by tools that support earlier versions of the Language. The changes pending to the different schemas are outlined below. "Open" status means the item is under consideration or being worked upon and "Closed" status means that the item has been incorporated and work on it is completed. For full details on a particular item please expand the item by clicking the + icon in the left column.

Tracker items in this version include:

The owrite and oexec entity documentation in the macos-def:diskutil_state and macos-sc:diskutil_item is incorrect because they have the documentation from the oread entity.

Date Added: 2012-01-18 00:46:17
This change will be available in Version 5.10.1 Release Candidate 2.

We need to fix win-sc:EntityItemWindowsViewType documentation for the empty string because it says that it is associated with variable references when it should really be associated with error and not collected conditions.

Date Added: 2012-01-18 00:49:11
This change will be available in Version 5.10.1 Release Candidate 2.

We should deprecate the use of include_group behavior in these tests in favor of using the sid_sid_object. This will align with the other effective rights and audited permissions tests.

Date Added: 2012-01-18 00:47:36
These changes will be available in Version 5.10.1 Release Candidate 2

In OVAL 5.10, the extended_name entity was accidentally left out of the linux-def:rpmverifypackage_state.  We need to add this entity to the state to allow for content authors to map between the various rpm-based tests.
 
Please see the following oval-developer-list post for additional information.

http://making-security-measurable.1364806.n2.nabble.com/Issues-with-the-linux-def-rpmverifyfile-test-and-linux-def-rpmverifypackage-test-in-OVAL-5-10-tp7055684p7055684.html

Date Added: 2011-12-13 15:38:02
This change will be available in Version 5.10.1 draft 1.

The minOccurs attributes on the name, epoch, version, release, and arch entities, in the linux-def:rpmverifypackage_object and the linux-def:rpmverifyfile_object, are incorrectly set to "0".  As a result, these objects will pass validation without having these entities which are needed to uniquely identify an rpm on a system.  We need to change the minOccurs attribute for these entities to "1".  

Please see the following oval-developer-list post for additional information.

http://making-security-measurable.1364806.n2.nabble.com/Issues-with-the-linux-def-rpmverifyfile-test-and-linux-def-rpmverifypackage-test-in-OVAL-5-10-tp7055684p7055684.html

Date Added: 2011-12-13 15:38:43
This change will be available in Version 5.10.1 draft 1.

We need to update the schema_version entity in the oval:GeneratorType to align with the new three-part version identifier in the OVAL Language Versioning Methodology.  The version attribute in the xs:schema element does not need to be updated because it is of type xs:token which allows for the three-part version identifier.

Date Added: 2011-12-13 15:38:59
This change will be available in Version 5.10.1 draft 1.

We need to update the foreign_port documentation in the linux-def:inetlisteningservers_test to not recommend using "*" for unestablished connections, but, rather "0" as that is what the operating system sees.

Please see the following oval-developer-list for additional information.

http://making-security-measurable.1364806.n2.nabble.com/Potential-schema-issue-with-http-oval-mitre-org-XMLSchema-oval-system-characteristics-5-linux-foreig-tp7177176p7177176.html

Date Added: 2012-01-18 00:55:50
This change will be available in Version 5.10.1 Release Candidate 2.

The version element in the oval:DeprecatedInfoType needs to align with the three-component version identifier in the new versioning policy.

Date Added: 2012-01-18 00:53:12
This change will be available in Version 5.10.1 Release Candidate 2.

Timeline for Version 5.10.1

Status Reports

Status updates are included below. You may also review the OVAL Developer’s Forum Archives for discussions about Version 5.10.1.

Page Last Updated: April 28, 2015