Loren Bandiera’s weblog

Was doing some work for a client on the weekend with Microsoft Exchange 2003. I ran into this error:

How does something like that even pass QA?

Sussen 0.90 has been released. Sussen is a tool that checks for vulnerabilities and configuration issues on computer systems.

We are getting closer to v1.0. The remaining items to do are to fix the remaining bugs in bugzilla, clean up the look/feel of the web console. The editor has been disabled for now, it won’t be ready in time for 1.0, but we’ll keep working on it for the 1.1/1.2 branch.

We are also working on setting up an OVAL repository so we can provide updated definitions in a more timely manner. I’ll have more details on that later.

Changes since 0.35:

• editor: Disabled editor; will continue development in 1.1/1.2 branch
• oval: Added initial support for OVAL 5.3
• oval: API documentation updated
• misc: Change license to GPL v3
• www: Various improvements to web console
• xml: Updated Ubuntu definitions for USNs 425-1 to 483-1
• xml: Updated Windows definitions from oval.mitre.org

Downloads: tar.gz | .rpm (Fedora Core 7) | .deb (Ubuntu 6.06) | .deb (Ubuntu 7.04) | .msi (Windows)

Sussen 0.35 has been released. Sussen is a tool that checks for vulnerabilities and configuration issues on computer systems. Changes since 0.34:

• editor: Fixed crash if definitions were selected and list was empty
• misc: Improved i18n support in agent,applet and editor
• misc: Updated build to use po/LINGUAS
• oval: Added support for OVAL 5.1 and 5.2
• oval: Fixed error in handling of check attribute on tests
• oval: Fixed regression in handling of definitions on wrong platform
• xml: Updated Ubuntu definitions for USNs 413-1 to 424-1
• xml: Updated Windows definitions from oval.mitre.org

Downloads: tar.gz | .rpm (Fedora Core 6) | .deb (Ubuntu) | .msi (Windows)

Earlier today, Sussen was certified as being OVAL compatible. Here is the message we got:

Congratulations! MMG Security’s Sussen has been granted official OVAL
Compatibility. The OVAL Community is excited to add you to the growing
list of products and services that have embraced the initiative and are
working to make IT Security better for all.

The OVAL web site should now reflect this status. We will also be
presenting you with a formal certificate, either by mail or at an
upcoming conference.

Thank you again for you support of OVAL!

Currently it’s only for the Windows version though. We had some issues with XML validation under Linux/Mono. We reported the bugs, they got fixed and are just waiting for the next Mono release. Since the Linux and Windows versions share 90%+ of their code we don’t expect any major issues getting the Linux version certified as well.

Sussen 0.34 has been released. Sussen is a tool that checks for vulnerabilities and configuration issues on computer systems. Changes since 0.33:

• agent: Fixed crash when loading app.config in Mono 1.1.13.x
• applet: Save results to desktop if explict path not specified
• applet: Run as tray icon by default
• oval: Fixed incorrect behavior in variable handling
• oval: Increased debug information available
• oval: Make sure all tested objects are recorded in system characteristics
• oval: Record variable values in system characteristics
• oval: Fixed error in behaviors handling for FileEffectiveRightsTest (Windows)
• xml: Updated Ubuntu definitions for USNs 390-1 to 412-1
• xml: Updated Windows definitions from oval.mitre.org

Downloads: tar.gz | .rpm (Fedora Core 6) | .deb (Ubuntu) | .msi (Windows)

Sussen 0.33 has been released. Sussen is a tool that checks for vulnerabilities and configuration issues on computer systems. Changes since 0.32:

• oval: Improved DataCollector handling of collected objects
• oval: Include variable values in system characteristics
• oval: Fixed logic error in FileEffectiveRightsTest (Windows)
• oval: Rewrote SidTest (Windows)
• oval: XML comments in the definition file caused an error
• oval: Fixed incorrect test names in LocalVariable.GetObjectValue() method
• oval: Return ‘not applicable’ if definition family doesn’t match platform
• www: Updated webservice API arguments to be consistent across methods
• www: Interoperability fixes for web service
• xml: Updated Ubuntu definitions for USNs 364-1 to 390-1
• xml: Added definition test suite

Downloads: tar.gz | .rpm (Fedora Core 6) | .deb (Ubuntu) | .msi (Windows)

Sussen 0.32 has been released. Sussen is a tool that checks for vulnerabilities and configuration issues on computer systems. Changes since 0.31:

• agent: Updated agent to work with new web service interface
• oval: Make sure to get full file version in File test (Windows)
• oval: Merged missing extend_definition patch from trunk (Windows)
• oval: Fixed logic error in VersionType comparison operators
• oval: results_to_html.xsl uses color coded rows again
• oval: Updated monodoc documentation for oval libraries
• www: Implemented start of proposed OVAL:SOA interface
• www: Web service works under Linux / mod_mono / MySQL
• www: Database schema updated

Downloads: tar.gz | .rpm (Fedora Core 6) | .deb (Ubuntu) | .msi (Windows)