<html> <head> <meta content="text/html; charset=windows-1252" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> <div class="moz-cite-prefix">On 1/27/17 2:53 AM, Sona Sarmadi wrote: </div> <blockquote cite="mid:3230301C09DEF9499B442BBE162C5E48AC314402@SESTOEX04.enea.se" type="cite"> Thanks for your quick reply Shawn.<o:p></o:p><o:p> </o:p> I am trying to figure out how OVAL definitions work. <o:p></o:p> For example if I want to detect unpatched CVEs in my RedHat Linux 6, I should use OVAL definition below:<o:p></o:p><o:p> </o:p> <a moz-do-not-send="true" href="https://www.redhat.com/security/data/oval/Red_Hat_Enterprise_Linux_6.xml">https://www.redhat.com/security/data/oval/Red_Hat_Enterprise_Linux_6.xml</a><o:p></o:p> Does this file (Red_Hat_Enterprise_Linux_6.xml) contains all CVEs which affects Redhat Linux 6 or only those which have been fixed? <o:p></o:p> If I haven’t applied all fixes provided by RedHat, will the command below detect and report those CVEs? <o:p></o:p> oscap oval eval --results rhsa-results-oval.xml --report oval-report-RedHat6.html Red_Hat_Enterprise_Linux_6.xml<o:p></o:p><o:p> </o:p> I am asking this because I haven’t updated my RedHat for a while, I think I should at least get some kernel CVEs reported, but the result is all green.<o:p></o:p> </blockquote> If there was a RHSA released, there should be a corresponding SCAP check. Ref: <a class="moz-txt-link-freetext" href="https://access.redhat.com/articles/221883">https://access.redhat.com/articles/221883</a> The command is correct. It seems a bit odd that you have no findings, if your system hasn't been patched for awhile (e.g. stock install of RHEL 6.8). WRT how the OVAL works, an example from the firefox patches last week: - First, OVAL will see what RHEL version you're on, and even derivative (RHEL6 vs RHEL6 Workstation vs RHEL6 Desktop): <blockquote type="cite"> <meta charset="utf-8"> <div class="line" style="color: rgb(0, 0, 0); font-family: monospace; font-size: 13px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><criteria operator="OR"></div> <div class="collapsible-content" style="margin-left: 1em; color: rgb(0, 0, 0); font-family: monospace; font-size: 13px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"> <div class="line"><criterion comment="Red Hat Enterprise Linux 6 Client is installed" test_ref="oval:com.redhat.rhsa:tst:20170190004"/></div> <div class="line"><criterion comment="Red Hat Enterprise Linux 6 Server is installed" test_ref="oval:com.redhat.rhsa:tst:20170190005"/></div> <div class="line"><criterion comment="Red Hat Enterprise Linux 6 Workstation is installed" test_ref="oval:com.redhat.rhsa:tst:20170190006"/></div> <div class="line"><criterion comment="Red Hat Enterprise Linux 6 ComputeNode is installed" test_ref="oval:com.redhat.rhsa:tst:20170190007"/></div> </div> <div class="line" style="color: rgb(0, 0, 0); font-family: monospace; font-size: 13px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"></criteria></div> </blockquote> - Second, it will check what version of firefox is installed (e.g. if it's the old nonpatched version, fail the check). It will also make sure the RPM is signed by RedHat, so we're not passing RPMs released by 3rd parties. <blockquote type="cite"> <meta charset="utf-8"> <div class="collapsible" id="collapsible34" style="color: rgb(0, 0, 0); font-family: monospace; font-size: 13px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"> <div class="expanded"> <div class="line"><rpminfo_test xmlns="<a class="moz-txt-link-freetext" href="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">http://oval.mitre.org/XMLSchema/oval-definitions-5#linux</a>" check="at least one" comment="firefox is earlier than 0:45.7.0-1.el6_8"id="oval:com.redhat.rhsa:tst:20170190008" version="602"></div> <div class="collapsible-content" style="margin-left: 1em;"> <div class="line"><object object_ref="oval:com.redhat.rhsa:obj:20170190002"/></div> <div class="line"><state state_ref="oval:com.redhat.rhsa:ste:20170190006"/></div> </div> <div class="line"></rpminfo_test> </div> </div> </div> <span class="text" style="color: rgb(0, 0, 0); font-family: monospace; font-size: 13px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"> <div class="collapsible" id="collapsible35" style="color: rgb(0, 0, 0); font-family: monospace; font-size: 13px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"> <div class="expanded"> <div class="line"><span class="button collapse-button" style="user-select: none; cursor: pointer; display: inline-block; margin-left: -10px; width: 10px; background: url("data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' fill='#909090' width='10' height='10'><path d='M0 0 L8 0 L4 7 Z'/></svg>"); vertical-align: bottom; height: 10px;"><rpminfo_test xmlns="<a class="moz-txt-link-freetext" href="http://oval.mitre.org/XMLSchema/oval-definitions-5#linux">http://oval.mitre.org/XMLSchema/oval-definitions-5#linux</a>" check="at least one" comment="firefox is signed with Red Hat redhatrelease2 key"id="oval:com.redhat.rhsa:tst:20170190009" version="602"></div> <div class="collapsible-content" style="margin-left: 1em;"> <div class="line"><object object_ref="oval:com.redhat.rhsa:obj:20170190002"/></div> <div class="line"><state state_ref="oval:com.redhat.rhsa:ste:20170190002"/></div> </div> <div class="line"></rpminfo_test></div> </div> </div> </blockquote> </body> </html>