CPE automation and a call for feedback
Locked
12
12
 
|
|
|
|
Gary,
I don't know the internals of Windows so I will answer in generalities. For each product, get the version and other metadata for that product from WMIC and build the name. It really does not matter what algorithm we settle on as long as we all use the same one. If you think it is important to have property FOO in the name, then so be it. This is sort of like a hashing function. We want CPEId = f(a) to result in unique CPEIds for different a values (no collisions) and we want f(a') to never result in CPEid. As far as I am concerned a hash would make a great ID, it is not backwards compatible so I am trying to play nice with others. We do not have the requirement that CPEId be of constant length so the URI format is as good as any. Is WMIC not capable of collecting enough information to satisfy our pseudo hash function requirement? Regards, Vladimir Giszpenc Armadillo Technical Lead DSCI Contractor Supporting US Army CERDEC S&TCD IAD Tactical Network Protection Branch (732) 532-8959 > -----Original Message----- > From: Gary Newman [mailto:[hidden email]] > Sent: Friday, May 28, 2010 11:18 AM > To: [hidden email] > Subject: Re: [CPE-DISCUSSION-LIST] CPE automation and a call for feedback > > Hi Vlad, > > What would the proposed automated f() CPE generator do with the following WMIC > "products" that appear after installing Sql Server 2008 on a computer? > > -Gary- > > Microsoft Application Error Reporting > Microsoft SQL Server 2008 BI Development Studio > Microsoft SQL Server 2008 Books Online (August 2008) > Microsoft SQL Server 2008 Browser > Microsoft SQL Server 2008 Client Tools > Microsoft SQL Server 2008 Common Files > Microsoft SQL Server 2008 Database Engine Services > Microsoft SQL Server 2008 Database Engine Shared > Microsoft SQL Server 2008 Database Engine Shared > Microsoft SQL Server 2008 Integration Services > Microsoft SQL Server 2008 Management Studio > Microsoft SQL Server 2008 Native Client > Microsoft SQL Server 2008 Policies > Microsoft SQL Server 2008 Reporting Services > Microsoft SQL Server 2008 RsFx Driver > Microsoft SQL Server 2008 Setup Support Files > Microsoft SQL Server Compact 3.5 Design Tools ENU > Microsoft SQL Server Compact 3.5 SP1 English > Microsoft SQL Server Compact 3.5 SP1 Query Tools English > Microsoft SQL Server Compact 3.5 for Devices ENU > Microsoft SQL Server Database Publishing Wizard 1.2 > Microsoft SQL Server VSS Writer > Microsoft Visual Studio Tools for Applications 2.0 - ENU > SQL Server System CLR Types > Sql Server Customer Experience Improvement Program > > > > CPE gang, > > > > To query the system for a list of installed packages (and patches) > > authenticated scanners can use: > > > > On Windows there is WMI(C) > > On Fedora, RHEL and derivatives there is RPM > > On OS/X there is pkgutil > > On Suse there is zypper > > On Debian and derivatives there is dpkg > > On Solaris there is pkginfo > > > > If we automate the above e.g. f(packagename, version, company, website, > > etc) = CPE ID, we solve a large portion of the problem. This will not > > solve things installed from source, zips, or anything else that does not > > register the application. Those things need to be found and named, but > > it is harder. > > > > ... > > > > Respectfully, > > > > Vladimir Giszpenc > > Armadillo Technical Lead > > DSCI Contractor Supporting > > US Army CERDEC S&TCD IAD Tactical Network Protection Branch > > (732) 532-8959 > > |
smime.p7s (4K) |
|
|
|
|
|
|
|
|
|
Classification: UNCLASSIFIED
Caveats: NONE Just FYI, I'm still working on doing this within the DoD. We want to use CPE, but can't afford to depend on a manual mapping process to occur before pulling asset inventories. As a going-in position, I'm asking our vendors and government developers to basically treat anything that installs itself as an application as an application. We'll pull everything registered, including patches, updates, libraries, and plain 'ol garbage and report it all in CPE format. At some central level, we'll need to implement a process (with a manual component) that winnows out which ones are which. I've been working through what that would look like on Windows, Linux, HPUX, MacOS, and some other operating systems and still think it's more feasible than the current manual process that we've been floundering with for the last several years. I think we'll need the ability, at the central location to designate the "stuff" we find as either applications, updates (i.e. patches, "feature packs", non version-related software installs, etc), or "other." We'll want to keep the applications and patch info, and may/may not want to keep everything else. I think the NVD would be a great central point for the community to normalize discovered application names. I plan to discuss this with NIST. I developed a transform in Python that will take Windows registry entries for Displayname DisplayVersion Publisher and put them in CPE REGEX format, including the percent encoding. Not sure if there's interest on the list of working through the conversion logic, but I'm happy to provide it to anyone that wants it. Joseph L. Wolfkiel Engineering Group Lead DISA PEO MA/IA52 (703) 882-0772 [hidden email] -----Original Message----- From: B [mailto:[hidden email]] Sent: Friday, November 19, 2010 4:34 PM To: [hidden email] Subject: Re: [CPE-DISCUSSION-LIST] CPE automation and a call for feedback Hi Vlad and others. This thread seems to have stalled. It seems completely possible to automate large portions of the windows installed software. Check out this link showing an example of where the information is in the registry and powershell code to get at it. http://myitforum.com/cs2/blogs/yli628/archive/2008/01/16/powershell-script-to-list-installed-software-on-local-computer.aspx What is shown is for the local machine but for many a network query would provide the same data. The fields in the example show at least Displayname DisplayVersion Publisher already separated in the registry so re-parsing of the (psinfo etc) data would not be required. Similar info is available in MS SCCM (formerly SMS) reports for those who have deployed that. Standardizing on identifiers that can be programmatically gathered and verified would be great. -- View this message in context: http://making-security-measurable.1364806.n2.nabble.com/CPE-automation-and-a-call-for-feedback-tp5110199p5756685.html Sent from the CPE - Common Platform Enumeration mailing list archive at Nabble.com. Classification: UNCLASSIFIED Caveats: NONE |
|
|
|
|
Classification: UNCLASSIFIED
Caveats: NONE I've attached the script along with a sample input and output file (from one of my home computers). In the .zip file, there is a file cpetext.txt that contains the discovered registered 'applications' on a box. The applications are in pipe-delimited format with the name components in order product|vendor|version|installdate. The script windows_cpe_converter.py reads in the pipe-delimited file and outputs the application names in CPE-REGEX compliant format. A sample output is in the file cpenames.txt. If you want try it, you'll need to update the input file path to wherever you save the cpetext.txt file and update the output file to wherever you want it saved. The input file was built with a registry query that I can't give out, but the output is a simple pipe-delimited list in format product|vendor|version|install_date. Joseph L. Wolfkiel Engineering Group Lead DISA PEO MA/IA52 (703) 882-0772 [hidden email] -----Original Message----- From: Adam Montville [mailto:[hidden email]] Sent: Tuesday, November 23, 2010 2:09 PM To: [hidden email] Subject: Re: [CPE-DISCUSSION-LIST] CPE automation and a call for feedback (UNCLASSIFIED) I'd be interested in that script as well. -----Original Message----- From: Jagathpal Shobharani [mailto:[hidden email]] Sent: Sunday, November 21, 2010 7:58 PM To: [hidden email] Subject: Re: [CPE-DISCUSSION-LIST] CPE automation and a call for feedback (UNCLASSIFIED) Hi Joseph, I would be interested in the python script and check output format from it. Can you please pass it on to me. Regards, Shobha, CISSP Principal Engineer, RSA The Security Division of EMC -----Original Message----- From: WOLFKIEL, JOSEPH L CIV DISA PEO-MA [mailto:[hidden email]] Sent: Saturday, November 20, 2010 3:25 AM To: [hidden email] Subject: Re: [CPE-DISCUSSION-LIST] CPE automation and a call for feedback (UNCLASSIFIED) Classification: UNCLASSIFIED Caveats: NONE Just FYI, I'm still working on doing this within the DoD. We want to use CPE, but can't afford to depend on a manual mapping process to occur before pulling asset inventories. As a going-in position, I'm asking our vendors and government developers to basically treat anything that installs itself as an application as an application. We'll pull everything registered, including patches, updates, libraries, and plain 'ol garbage and report it all in CPE format. At some central level, we'll need to implement a process (with a manual component) that winnows out which ones are which. I've been working through what that would look like on Windows, Linux, HPUX, MacOS, and some other operating systems and still think it's more feasible than the current manual process that we've been floundering with for the last several years. I think we'll need the ability, at the central location to designate the "stuff" we find as either applications, updates (i.e. patches, "feature packs", non version-related software installs, etc), or "other." We'll want to keep the applications and patch info, and may/may not want to keep everything else. I think the NVD would be a great central point for the community to normalize discovered application names. I plan to discuss this with NIST. I developed a transform in Python that will take Windows registry entries for Displayname DisplayVersion Publisher and put them in CPE REGEX format, including the percent encoding. Not sure if there's interest on the list of working through the conversion logic, but I'm happy to provide it to anyone that wants it. Joseph L. Wolfkiel Engineering Group Lead DISA PEO MA/IA52 (703) 882-0772 [hidden email] -----Original Message----- From: B [mailto:[hidden email]] Sent: Friday, November 19, 2010 4:34 PM To: [hidden email] Subject: Re: [CPE-DISCUSSION-LIST] CPE automation and a call for feedback Hi Vlad and others. This thread seems to have stalled. It seems completely possible to automate large portions of the windows installed software. Check out this link showing an example of where the information is in the registry and powershell code to get at it. http://myitforum.com/cs2/blogs/yli628/archive/2008/01/16/powershell-script-to-list-installed-software-on-local-computer.aspx What is shown is for the local machine but for many a network query would provide the same data. The fields in the example show at least Displayname DisplayVersion Publisher already separated in the registry so re-parsing of the (psinfo etc) data would not be required. Similar info is available in MS SCCM (formerly SMS) reports for those who have deployed that. Standardizing on identifiers that can be programmatically gathered and verified would be great. -- View this message in context: http://making-security-measurable.1364806.n2.nabble.com/CPE-automation-and-a-call-for-feedback-tp5110199p5756685.html Sent from the CPE - Common Platform Enumeration mailing list archive at Nabble.com. Classification: UNCLASSIFIED Caveats: NONE Classification: UNCLASSIFIED Caveats: NONE |
|
|
In reply to this post by Adam Montville
Classification: UNCLASSIFIED
Caveats: NONE As you may have heard, I've been working with several vendors and DoD government software products to attempt to collect and report installed software in CPE format (or at least CPE 2.x RegEx-compliant format). One of the difficulties I encountered is that different operating systems (e.g. Microsoft, HPUX, Linux, MACOS, etc) provide different pieces of product names and call them different things. I'm thinking it would be helpful for interoperability and automation to put together a style guide for each operating system, defining what product name elements we can expect to retrieve and how to combine them together to construct CPEs in a way that will/may result in different vendor tools producing the same names for the same products installed on the same operating systems. Is there any interest in generating style guides like I've described above? Joseph L. Wolfkiel Engineering Group Lead DISA PEO MA/IA52 (703) 882-0772 [hidden email] Classification: UNCLASSIFIED Caveats: NONE |
|
|
|
|
|
|
|
|
|
|
|
|
Loading...
| Powered by Nabble | Edit this page |