UNITY 360: Issueshttp://www.prelude-siem.org/http://www.prelude-siem.org/welcome/themes/prelude/favicon/Prelude-icon.png2017-09-21T16:38:48ZUNITY 360
Redmine Prelude Correlator rules - Tache #907 (New): CVE-2017-9798 - OptionsBleed - Correlationhttp://www.prelude-siem.org/issues/9072017-09-21T16:38:48ZThomas ANDREJAKthomas.andrejak@csgroup.eu
<p>Options Bleed is a simple OPTIONS request, there is no specific patterns. But, to gather enough leaked piece of information to make a full one, the attacker need to request OPTIONS many time.</p> LibpreludeDB - Bug #898 (New): Add pkg-config filehttp://www.prelude-siem.org/issues/8982017-08-18T20:44:49ZThomas ANDREJAKthomas.andrejak@csgroup.eu
<p>as libprelude, please add pkg-config file</p> Libprelude - Bug #893 (New): libprelude-errors failed compile on hhurd-i386http://www.prelude-siem.org/issues/8932017-06-24T14:23:44ZThomas ANDREJAKthomas.andrejak@csgroup.eu
<pre>
make[6]: Entering directory '/<<PKGBUILDDIR>>/src/libprelude-error'
LANG="" gawk -f ./mkstrtable.awk -v textidx=3 \
./err-sources.h.in >err-sources.h
LANG="" gawk -f ./mkstrtable.awk -v textidx=3 \
./err-codes.h.in >err-codes.h
LANG="" gawk -f ./mkerrcodes1.awk ./errnos.in >_mkerrcodes.h
gcc -E -P _mkerrcodes.h | grep PRELUDE_ERROR_ | LANG="" gawk -f ./mkerrcodes.awk >mkerrcodes.h
rm _mkerrcodes.h
gcc -g -O2 -fdebug-prefix-map=/<<PKGBUILDDIR>>=. -specs=/usr/share/dpkg/pie-compile.specs -fstack-protector-strong -Wformat -Werror=format-security -I. -I. -o mkerrcodes ./mkerrcodes.c
In file included from ./mkerrcodes.c:26:0:
./mkerrcodes.h:3:3: error: expected identifier or '(' before numeric constant
((0x10 << 26) | ((7) & 0x3fff)) PRELUDE_ERROR_E2BIG
^~~~
./mkerrcodes.h:3:15: error: expected ')' before '|' token
((0x10 << 26) | ((7) & 0x3fff)) PRELUDE_ERROR_E2BIG
^
./mkerrcodes.c: In function 'main':
./mkerrcodes.c:59:31: error: 'err_table' undeclared (first use in this function)
for (i = 0; i < sizeof (err_table) / sizeof (err_table[0]) - 1; i++)
^~~~~~~~~
./mkerrcodes.c:59:31: note: each undeclared identifier is reported only once for each function it appears in
Makefile:1790: recipe for target 'mkerrcodes' failed
</pre> Libprelude - Bug #887 (New): Timer tests on slow systemhttp://www.prelude-siem.org/issues/8872017-05-14T14:22:27ZThomas ANDREJAKthomas.andrejak@csgroup.eu
<p>On slow system, sometimes, timer tests (tests/prelude-timer.c) work works.</p>
<p>Adding "1" to max_expire in for loop solve this</p>
<pre>
- for ( i = 0; i <= max_expire && timer_alive; i++ ) {
+ for ( i = 0; i <= max_expire + 1 && timer_alive; i++ ) {
</pre> Libprelude - Bug #886 (New): Sometimes, test-lock from libmissing wont workshttp://www.prelude-siem.org/issues/8862017-05-14T14:19:50ZThomas ANDREJAKthomas.andrejak@csgroup.eu
<p>Same issues in coreutils and other packages : <a class="external" href="http://pkgs.fedoraproject.org/cgit/rpms/coreutils.git/commit/?id=8d346246">http://pkgs.fedoraproject.org/cgit/rpms/coreutils.git/commit/?id=8d346246</a></p>
<p>Hope that gnulib will update this test</p> Libprelude - Bug #885 (New): Segfault with atfork on arm64, armhf and ppc64elhttp://www.prelude-siem.org/issues/8852017-05-14T14:16:45ZThomas ANDREJAKthomas.andrejak@csgroup.eu
<p>See <a class="external" href="https://bugs.launchpad.net/ubuntu/+source/libprelude/+bug/1262430">https://bugs.launchpad.net/ubuntu/+source/libprelude/+bug/1262430</a></p> Libprelude - Bug #879 (New): M4 for Ruby on Debian 9 not workinghttp://www.prelude-siem.org/issues/8792017-03-27T22:48:17ZThomas ANDREJAKthomas.andrejak@csgroup.eu
<p>The actual M4 (3.1, m4/am_path_ruby) can't detect ruby on debian 9</p>
<p>Here is an example of patch :</p>
<pre>
--- libprelude-3.1.0/m4/am_path_ruby.m4 2017-02-28 18:00:21.227299410 -0500
+++ libprelude-3.1.0/m4/am_path_ruby.m4 2017-02-28 18:01:06.702306372 -0500
@@ -95,7 +95,7 @@
dnl (shared libraries)
AC_CACHE_CHECK([for $am_display_RUBY extension module directory],
[am_cv_ruby_rbexecdir],
- [am_cv_ruby_rbexecdir=`$RUBY -rrbconfig -e "drive = File::PATH_SEPARATOR == ';' ? /\A\w:/ : /\A/; prefix = Regexp.new('\\A' + Regexp.quote(RbConfig::CONFIG[['prefix']])); \\$prefix = RbConfig::CONFIG[['prefix']].sub(drive, ''); \\$sitearchdir = RbConfig::CONFIG[['sitearchdir']].sub(prefix, '\\$(prefix)').sub(drive, ''); print \\$sitearchdir;" 2>/dev/null || echo "${RUBY_EXEC_PREFIX}/local/lib/site_ruby/${RUBY_VERSION}/${RUBY_PLATFORM}"`])
+ [am_cv_ruby_rbexecdir=`$RUBY -r rbconfig -e "print RbConfig::CONFIG[['vendorarchdir']]"`])
AC_SUBST([rbexecdir], [$am_cv_ruby_rbexecdir])
dnl if PKG-CONFIG is available, we use it. Else, we try to dectect RUBY_INCLUDES manually
</pre> Prelude Manager - Bug #878 (New): prelude-manager and Systemdhttp://www.prelude-siem.org/issues/8782017-02-27T22:38:08ZThomas ANDREJAKthomas.andrejak@csgroup.eu
<p>prelude-manager run dir is /var/run/prelude-manager</p>
<p>With systemd, /var/run move to /run</p> LibpreludeDB - Bug #867 (New): libpreludedb : missing -lpreludecpp when linkinghttp://www.prelude-siem.org/issues/8672017-01-11T08:24:33ZThomas ANDREJAKthomas.andrejak@csgroup.eu
<p>With rpmlint, I got this :<br /><pre>
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 typeinfo for Prelude::PreludeError
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 Prelude::PreludeError::what() const
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 Prelude::IDMEFValue::isNull() const
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 Prelude::IDMEFValue::~IDMEFValue()
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 Prelude::IDMEFValue::operator idmef_value*() const
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 Prelude::IDMEFValue::toString[abi:cxx11]() const
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 Prelude::IDMEF::operator idmef_object*() const
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 Prelude::IDMEFValue::IDMEFValue(idmef_value*)
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 Prelude::PreludeError::PreludeError()
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 vtable for Prelude::PreludeError
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 Prelude::IDMEFValue::getType() const
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 Prelude::IDMEFPath::operator idmef_path*() const
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 Prelude::IDMEF::IDMEF(idmef_object*)
libpreludedb.x86_64: W: undefined-non-weak-symbol /usr/lib64/libpreludedbcpp.so.2.1.0 Prelude::IDMEFCriteria::operator idmef_criteria*() const
</pre></p>
<p>This is because, in bindings/c++/Makefile, the variable "libpreludedbcpp_la_LDFLAGS" is missing "-lpreludecpp"</p>
<p>Also, it seems that libprelude-config never provide -lpreludecpp</p> LibpreludeDB - Bug #866 (New): libpreludedb : manpages warninghttp://www.prelude-siem.org/issues/8662017-01-11T08:22:05ZThomas ANDREJAKthomas.andrejak@csgroup.eu
<p>When running rpmlint, I got this :<br /><pre>
libpreludedb-devel.x86_64: W: manual-page-warning /usr/share/man/man1/libpreludedb-config.1.gz 23: a special character is not allowed in a name
</pre></p>
<p>Patch :<br /><pre>
--- ./docs/manpages/libpreludedb-config.1 2016-09-15 08:49:14.234000884 +0200
+++ ./docs/manpages/libpreludedb-config.1 2017-01-10 08:22:39.280448484 +0100
@@ -20,7 +20,7 @@
.B \-\-libs
options.
This option must be specified before any
-.B\-\-libs
+.B \-\-libs
or
.B \-\-cflags
options. This
</pre></p> Libprelude - Bug #860 (Assigned): Fedora : ruby sitearchdir need to be vendorarchdirhttp://www.prelude-siem.org/issues/8602016-10-31T21:33:18ZThomas ANDREJAKthomas.andrejak@csgroup.eu
<p>On Fedora, sitearchdir is not defined, so ruby "so" file go to /usr/local.</p>
<p>On Fedora it is vendorarchdir</p> LibpreludeDB - Bug #392 (Assigned): Potential security risc in preludedb-admin?http://www.prelude-siem.org/issues/3922011-01-15T15:37:50ZPaul Buetowprelude@mx.buetow.org
<p>Hi!</p>
<p>I wanted to ask a question regarding preludedb-admin.</p>
<p>I am using 0.9.14.1-2 (Debian GNU/Linux Lenny). There is no way not to<br />define the database password (e.g. mysql password) NOT in the command<br />line argument. The password shows up in plain text in the system<br />process list while using preludedb-admin.</p>
<p>It should be possible to "pipe" the arguments to preludedb-admin</p>
<p>The current way:</p>
<p>preludedb-admin delete alert "type=mysql name=prelude user=prelude<br />pass=prelude" --criteria "alert.create_time < $DATE"</p>
<p>"Better way":</p>
<p>some-script-generating-arguments | preludedb-admin</p>
<p>(Alternatively just pipe the "type=mysql name=prelude user=prelude" <br />part)</p>
<p>And / Or:</p>
<p>preludedb-admin --args filename</p>
<p>(Alternatively just read the "type=mysql name=prelude user=prelude" <br />part from file)</p>
<p>And / Or:</p>
<p>Read password from an environment variable:</p>
<p>#/bin/sh</p>
<p>export PRELUDE_PASS=prelude<br />exec preludedb-admin delete alert "type=mysql name=prelude<br />user=prelude" --criteria "alert.create_time < $DATE"</p>
<p>And / Or:</p>
<p>Read password from stdin if missing in the argument.</p>
<p>Hope you got my point <img src="/plugin_assets/redmine_wiki_extensions/images/smile.png" alt=":)"></p>
<p>Thanks a lot and best regards,</p> Prelude Correlator - Feature #375 (Assigned): Prelude Correlator upper event limithttp://www.prelude-siem.org/issues/3752010-04-06T19:40:57ZJames Chappleheatgod@verizon.net
<p>When a corrleated event such as Eventscan or Eventstorm contains large numbers of events, the Prewikka GUI times out and is unable to display the event details. On several test systems available to me, the threshold seemed to be around 5K events. This was discovered during a Nessus scan of monitored systems, where Nessus is scanning every port. Iptables is logging every blocked port, potentially generating many thousands of events during the window.</p>
<p>The ability to specify an upper limit in the Correlator rules for a given correlated event would be useful to prevent excessive messages in a single event.</p> PRELUDE SIEM - Bug #343 (New): OSSEC-HIDS 1.6.1 always sets assessment.impact.completion = succededhttp://www.prelude-siem.org/issues/3432009-01-25T20:06:12Z
<p>Example: the IDMEF alerts for both of these logs</p>
<pre>
[[WinEvtLog]]: Security: AUDIT_SUCCESS(673): Security: SYSTEM: NT AUTHORITY: SERVER: user@DOMAIN DOMAIN PC$ %{SOMERANDOMUIDHERE} 0x40810010 0x17 10.10.10.10 - {SOMEOTHERUID} -
[[WinEvtLog]]: Security: AUDIT_FAILURE(673): Security: SYSTEM: NT AUTHORITY: SERVER: - 0x2 - 10.10.10.10 0x20 - -
</pre>
<p>have assessment.impact.completion = succeeded</p>
<p>See also: <a class="external" href="http://marc.info/?t=123274084100006&r=1&w=2">http://marc.info/?t=123274084100006&r=1&w=2</a></p> LibpreludeDB - Bug #337 (New): Fake result number of deleted records in preludedb-adminhttp://www.prelude-siem.org/issues/3372008-12-08T17:16:54Z
<p>The output of preludedb-admin was:</p>
<p>delete event failed: Lost connection to [[MySQL]] server during query.</p>
<p>Error at transaction 448000. Use --offset 874000 to resume operation.</p>
<p>2152124949 'delete' events processed in 2783.401760 seconds (0.000001 seconds/events - 773199.535880 delete/sec average).</p>
<p>2152124949 events processed in 2783.401760 seconds (0.000001 seconds/events - 773199.535880 events/sec average).</p>
<p>2152124949 is the fake as '--offset 874000' says where it stopped.</p>