Open Vulnerability and Assessment Language

[2006-05-25]

A third release candidate is now available. Changes to the schema include improved documentation to make clear how pieces of the language should be interpreted. Changes that affect validation of content include a slight modification to the id format in order to allow numbers (in addition to the previously allowed letters) in the unique string portion; a change to the Solaris patch_test where the base and version entities were switched from strings to ints (this was an oversight in the schemas and we are correcting the mistake); and the inetd_test (UNIX schema) and the inetlisteningservers_test (Linux schema) where the object and state entities were modified to reflect an issue brought to our attention in which both tests used a name entity as the object, but the name was not a unique value. See the updated schema files below for the new implementation.

[2006-05-04]

A second beta version of the reference OVAL Interpreter for the Version 5.0 Release Candidates that adds support for Red Hat Linux is now available. Specifically, this second beta adds support for the following: RC2 of the Version 5 OVAL Schemas; Linux data collection for two objects, rpminfo_object and inetlisteningservers_object; data collection for three objects: file_object, process_object, and uname_object; Windows data collection for the wmi_object; stubs for future Sun Solaris implementation; and restructuring of the source tree to better mirror the OVAL Schema.

[2006-04-27]

The sample Data Files for the Version 5.0 OVAL Schema Release Candidates have been updated. These samples may be used with the beta version of the Version 5.0 reference OVAL Interpreter and should also be reviewed and tested by vendors as part of their migration to the new version of OVAL scheduled for release on June 16, 2006. The V5 Data File updates include the addition of three new sample files: all Windows definitions in the Definitions Repository converted to V5; all Red Hat Linux definitions in the Definitions Repository converted to V5; and a set of Solaris definitions converted to V5.

[2006-04-06]

A second Release Candidate (RC) of Version 5 is now available that incorporates the common Linux schema that was discussed on the Developer List. You will notice that the Red Hat and Debian schemas have disappeared since those tests have been moved to the Linux and UNIX schemas. No changes have been made to the actual tests, they have just changed namespaces. More specifically, the inetd_test, password_test, and shadow_test can be found in the UNIX schema, while the dpkginfo_test, inetlisteningserver_test, and rpminfo_test can be found in the Linux schema.

In addition, three other small changes have been made. A runlevel_test has been added to the UNIX schema to test for runlevel properties of UNIX services. A recurse_file_system behavior has been added to the UNIX file_test to guide data collection related to local and remote mounted file systems. And the <filename> entity of the fileauditedpermissions_test and the fileeffectiverights_test allows nillable to be set in order to specify a directory.

[2006-03-16]

The first Release Candidate (RC) for the Version 5.0 OVAL Schemas is now available. Vendors should begin their migration to this new version in preparation for its release on June 16, 2006.

RC1 contains the Schematron code used to perform stylesheet validation. It also adds Apache to the list of supported operating systems and applications.

[2006-03-16]

A beta version of the reference OVAL Interpreter for the Version 5.0 OVAL Schema Release Candidate is available for download for Windows. This release supports all of the most commonly used OVAL tests for Windows in addition to several other tests defined in the Independent Schema. Support for additional Windows tests will be provided at a later date. The next release of the OVAL Interpreter will include support for Red Hat and any bug fixes that are needed.

Sample data files that include a partial sample of the definitions and schemas for Version 5.0 are also available for use with the Interpreter release candidate.

[2006-02-02]

Draft 6 for Version 5 of the OVAL Schema cleans up the variable section by modifying the look of local variables. Added to the mix is a more uniform way of performing basic functions like concat and substring. This allows more control over how a definition writer can expresses the exact values needed.

Also in this draft was the split of the EntityBaseType into two separate types, one for Objects and one for States. The reason for this change was to enforce the fact that the entity_check attribute should only be available to entity states.

[2006-01-20]

A fifth draft for Version 5.0 has been released. This draft contains a re-worked variable structure that has a new format for local and external variables. The variable work includes the addition of a var_check attribute to the base entity type facilitating the use multiple values for variables. The var_check attribute also means that unbounded entities with OVAL States are no longer appropriate and have been reduced to a max occurs of 1.

In addition, a set now requires at least one obj_ref or child set element, but is limited to a max of 2 obj_ref or child set elements. This change was made to clear up confusion over how to perform the set operations against more than 2 sets.

The fifth draft also moved the md5 entity out of the file test and placed it in a separate filemd5_test under the independent schema. The reason for this being that calculating the md5 can take a substantial amount of processing time and is not normally needed as part of the file attributes.

[2005-12-16]

The forth draft for Version 5.0 includes updated HP-UX, Debian Linux, and Cisco IOS component schemas. In addition, it introduces a common core schema that defines shared types used by the Definition, System Characteristics, and Results schemas. Other changes include the elimination of the extended_only attribute, the addition of an environment variable test and a family test, and the removal of object references from inside object declarations.

The variable structure has also been updated with the removal of the source attribute and the creation of three different variable types: local_variable, external_variable, and constant_variable. These changes have not affected the functionality of variables, just the structure.

In addition, deprecation of OVAL definitions has been modified with the removal of the "Deprecation" class and the addition of a deprecated attribute for the each of the major core elements.

[2005-12-02]

The third draft for Version 5 of the OVAL schema has been released. It includes updated MacOS and Solaris schemas. In addition to the new component schemas, a negate attribute has been added to the criteria element. This functionality existed in version 4 by negating compound_tests. The value of variables used in collecting system characteristic data was also added through a variable_value element. This enables tools to determine the instance of an item to use during analysis.

[2005-11-17]

A second draft for Version 5.0 has been released. This draft contains the full set of schemas pertaining to Red Hat Linux and Microsoft Windows operating systems, as well as the core and independent schemas. Of note is the improved OVAL System Characteristics format that incorporates a mapping from objects to items. This mapping is a break from Version 4 ideology that tried to isolate a System Characteristic document from a Definition document.

In addition, a new way of encoding the effective rights tests has been incorporated. Notice that these tests simply combine existing registry and sid objects. See the provided examples for a look at the implementation.

Additional draft component schemas for Solaris, Debian, HP-UX, MacOS, and IOS will be available shortly.

[2005-10-21]

The first draft for Version 5.0 has now been released. Currently this initial draft release only contains the schema files that have been completed. Additional files will be added as they are completed. Version 5.0 will progress through a number of drafts as MITRE continues to hammer out the details. Please send any comments about the Version 5.0 draft to the OVAL Community Forum.