rafabailon
commented
1 month ago Test
Agent Simulator 🟢
```console root@ubuntu2204:/home/vagrant# simulate-agents -a 172.16.1.13 -n 1 -m syscollector -s 5 -t 12 -o debian10 -v 4.8.0 --debug DEBUG:root:Registration - 1-bpcFltYPL7Ud8wR0-debian10(021) in 172.16.1.13 DEBUG:root:Keep alive message = #!-Linux |agent-debian10 |4.9.0-12-amd64 |#1 SMP Debian 4.9.210-1 (2020-01-20) |x86_64 [Debian GNU/Linux|debian: 10 (buster)] - Wazuh v4.8.0 / ab73af41699f13fdd81903b5f23d8d00 d6e3ac3e75ca0319af3e7c262776f331 merged.mg #"_agent_ip":10.0.2.15 INFO:P8185:{'keepalive': {'status': 'enabled', 'frequency': 10.0}, 'fim': {'status': 'disabled', 'eps': 0}, 'fim_integrity': {'status': 'disabled', 'eps': 0}, 'syscollector': {'status': 'enabled', 'frequency': 60, 'eps': 5}, 'rootcheck': {'status': 'disabled', 'frequency': 60.0, 'eps': 0}, 'sca': {'status': 'disabled', 'frequency': 60, 'eps': 0}, 'hostinfo': {'status': 'disabled', 'eps': 0}, 'winevt': {'status': 'disabled', 'eps': 0}, 'logcollector': {'status': 'disabled', 'eps': 0}, 'receive_messages': {'status': 'enabled'}} INFO:P8185:Waiting 0 seconds before sending EPS and keep-alive events INFO:P8185:Starting 1 agents. DEBUG:root:Starting - 1-bpcFltYPL7Ud8wR0-debian10(021)(debian10) - keepalive DEBUG:root:Starting - 1-bpcFltYPL7Ud8wR0-debian10(021)(debian10) - syscollector DEBUG:root:Starting - 1-bpcFltYPL7Ud8wR0-debian10(021)(debian10) - receive_messages DEBUG:root:Startup - 1-bpcFltYPL7Ud8wR0-debian10(021) DEBUG:root:KeepAlive - 1-bpcFltYPL7Ud8wR0-debian10(021) DEBUG:root:Syscollector Event - d:syscollector:{"type": "dbsync_osinfo", "data": {"checksum":"1634140017886803554","architecture":"x86_64","hostname":"1-bpcFltYPL7Ud8wR0-debian10","os_codename":"focal","os_major":"20","os_minor":"04","os_name":"Ubuntu","os_platform":"ubuntu","os_patch":"6","os_release":"sp1","os_version":"20.04.6LTS(FocalFossa)","os_build":"4.18.0-305.12.1.el8_4.x86_64","release":"6.2.6-76060206-generic","scan_time":"2023/12/2011:24:58","sysname":"Linux","version":"#202303130630~1689015125~22.04~ab2190eSMPPREEMPT_DYNAMIC"}, "operation": "INSERTED"} DEBUG:root:Syscollector Event - d:syscollector:{"type": "dbsync_osinfo", "data": {"checksum":"1634140017886803554","architecture":"x86_64","hostname":"1-bpcFltYPL7Ud8wR0-debian10","os_codename":"focal","os_major":"20","os_minor":"04","os_name":"Ubuntu","os_platform":"ubuntu","os_patch":"6","os_release":"sp1","os_version":"20.04.6LTS(FocalFossa)","os_build":"4.18.0-305.12.1.el8_4.x86_64","release":"6.2.6-76060206-generic","scan_time":"2023/12/2011:24:58","sysname":"Linux","version":"#202303130630~1689015125~22.04~ab2190eSMPPREEMPT_DYNAMIC"}, "operation": "INSERTED"} DEBUG:root:Syscollector Event - d:syscollector:{"type": "dbsync_osinfo", "data": {"checksum":"1634140017886803554","architecture":"x86_64","hostname":"1-bpcFltYPL7Ud8wR0-debian10","os_codename":"focal","os_major":"20","os_minor":"04","os_name":"Ubuntu","os_platform":"ubuntu","os_patch":"6","os_release":"sp1","os_version":"20.04.6LTS(FocalFossa)","os_build":"4.18.0-305.12.1.el8_4.x86_64","release":"6.2.6-76060206-generic","scan_time":"2023/12/2011:24:58","sysname":"Linux","version":"#202303130630~1689015125~22.04~ab2190eSMPPREEMPT_DYNAMIC"}, "operation": "INSERTED"} DEBUG:root:Syscollector Event - d:syscollector:{"type": "dbsync_osinfo", "data": {"checksum":"1634140017886803554","architecture":"x86_64","hostname":"1-bpcFltYPL7Ud8wR0-debian10","os_codename":"focal","os_major":"20","os_minor":"04","os_name":"Ubuntu","os_platform":"ubuntu","os_patch":"6","os_release":"sp1","os_version":"20.04.6LTS(FocalFossa)","os_build":"4.18.0-305.12.1.el8_4.x86_64","release":"6.2.6-76060206-generic","scan_time":"2023/12/2011:24:58","sysname":"Linux","version":"#202303130630~1689015125~22.04~ab2190eSMPPREEMPT_DYNAMIC"}, "operation": "INSERTED"} DEBUG:root:Syscollector Event - d:syscollector:{"type": "dbsync_osinfo", "data": {"checksum":"1634140017886803554","architecture":"x86_64","hostname":"1-bpcFltYPL7Ud8wR0-debian10","os_codename":"focal","os_major":"20","os_minor":"04","os_name":"Ubuntu","os_platform":"ubuntu","os_patch":"6","os_release":"sp1","os_version":"20.04.6LTS(FocalFossa)","os_build":"4.18.0-305.12.1.el8_4.x86_64","release":"6.2.6-76060206-generic","scan_time":"2023/12/2011:24:58","sysname":"Linux","version":"#202303130630~1689015125~22.04~ab2190eSMPPREEMPT_DYNAMIC"}, "operation": "INSERTED"} DEBUG:root:Syscollector Event - d:syscollector:{"type": "dbsync_osinfo", "data": {"checksum":"1634140017886803554","architecture":"x86_64","hostname":"1-bpcFltYPL7Ud8wR0-debian10","os_codename":"focal","os_major":"20","os_minor":"04","os_name":"Ubuntu","os_platform":"ubuntu","os_patch":"6","os_release":"sp1","os_version":"20.04.6LTS(FocalFossa)","os_build":"4.18.0-305.12.1.el8_4.x86_64","release":"6.2.6-76060206-generic","scan_time":"2023/12/2011:24:58","sysname":"Linux","version":"#202303130630~1689015125~22.04~ab2190eSMPPREEMPT_DYNAMIC"}, "operation": "INSERTED"} DEBUG:root:Syscollector Event - d:syscollector:{"type": "dbsync_osinfo", "data": {"checksum":"1634140017886803554","architecture":"x86_64","hostname":"1-bpcFltYPL7Ud8wR0-debian10","os_codename":"focal","os_major":"20","os_minor":"04","os_name":"Ubuntu","os_platform":"ubuntu","os_patch":"6","os_release":"sp1","os_version":"20.04.6LTS(FocalFossa)","os_build":"4.18.0-305.12.1.el8_4.x86_64","release":"6.2.6-76060206-generic","scan_time":"2023/12/2011:24:58","sysname":"Linux","version":"#202303130630~1689015125~22.04~ab2190eSMPPREEMPT_DYNAMIC"}, "operation": "INSERTED"} DEBUG:root:Syscollector Event - d:syscollector:{"type": "dbsync_osinfo", "data": {"checksum":"1634140017886803554","architecture":"x86_64","hostname":"1-bpcFltYPL7Ud8wR0-debian10","os_codename":"focal","os_major":"20","os_minor":"04","os_name":"Ubuntu","os_platform":"ubuntu","os_patch":"6","os_release":"sp1","os_version":"20.04.6LTS(FocalFossa)","os_build":"4.18.0-305.12.1.el8_4.x86_64","release":"6.2.6-76060206-generic","scan_time":"2023/12/2011:24:58","sysname":"Linux","version":"#202303130630~1689015125~22.04~ab2190eSMPPREEMPT_DYNAMIC"}, "operation": "INSERTED"} DEBUG:root:Syscollector Event - d:syscollector:{"type": "dbsync_osinfo", "data": {"checksum":"1634140017886803554","architecture":"x86_64","hostname":"1-bpcFltYPL7Ud8wR0-debian10","os_codename":"focal","os_major":"20","os_minor":"04","os_name":"Ubuntu","os_platform":"ubuntu","os_patch":"6","os_release":"sp1","os_version":"20.04.6LTS(FocalFossa)","os_build":"4.18.0-305.12.1.el8_4.x86_64","release":"6.2.6-76060206-generic","scan_time":"2023/12/2011:24:58","sysname":"Linux","version":"#202303130630~1689015125~22.04~ab2190eSMPPREEMPT_DYNAMIC"}, "operation": "INSERTED"} DEBUG:root:Syscollector Event - d:syscollector:{"type": "dbsync_osinfo", "data": {"checksum":"1634140017886803554","architecture":"x86_64","hostname":"1-bpcFltYPL7Ud8wR0-debian10","os_codename":"focal","os_major":"20","os_minor":"04","os_name":"Ubuntu","os_platform":"ubuntu","os_patch":"6","os_release":"sp1","os_version":"20.04.6LTS(FocalFossa)","os_build":"4.18.0-305.12.1.el8_4.x86_64","release":"6.2.6-76060206-generic","scan_time":"2023/12/2011:24:58","sysname":"Linux","version":"#202303130630~1689015125~22.04~ab2190eSMPPREEMPT_DYNAMIC"}, "operation": "INSERTED"} DEBUG:root:Syscollector Event - d:syscollector:{"type": "dbsync_packages", "data": {"architecture":"","checksum":"LJVKW66TGN","description":"","format":"","groups":"editors","install_time":"2024/04/16 00:00:00","item_id":"GOJOKI0JO8","location":"","multiarch":"null","name":"bsd_os","priority":"optional","scan_time":"2023/12/1915:32:25","size":"11","source":"","vendor":"bsdi","version":"3.1"}, "operation": "INSERTED"} DEBUG:root:Syscollector Event - d:syscollector:{"type": "dbsync_packages", "data": {"architecture":"","checksum":"4KBI6XU15Q","description":"","format":"","groups":"editors","install_time":"2024/04/16 00:00:00","item_id":"ZPZ0QGFUIE","location":"","multiarch":"null","name":"freebsd","priority":"optional","scan_time":"2023/12/1915:32:25","size":"12","source":"","vendor":"freebsd","version":"1.0"}, "operation": "INSERTED"} DEBUG:root:Syscollector Event - d:syscollector:{"type": "dbsync_packages", "data": {"architecture":"","checksum":"UADVGHEYMX","description":"","format":"","groups":"editors","install_time":"2024/04/16 00:00:00","item_id":"A45X5F2ECF","location":"","multiarch":"null","name":"freebsd","priority":"optional","scan_time":"2023/12/1915:32:25","size":"13","source":"","vendor":"freebsd","version":"1.1"}, "operation": "INSERTED"} DEBUG:root:Syscollector Event - d:syscollector:{"type": "dbsync_packages", "data": {"architecture":"","checksum":"7TWPG5GNVA","description":"","format":"","groups":"editors","install_time":"2024/04/16 00:00:00","item_id":"2N6OMTOS7P","location":"","multiarch":"null","name":"freebsd","priority":"optional","scan_time":"2023/12/1915:32:25","size":"14","source":"","vendor":"freebsd","version":"1.1.5.1"}, "operation": "INSERTED"} DEBUG:root:Syscollector Event - d:syscollector:{"type": "dbsync_packages", "data": {"architecture":"","checksum":"O0586C6ZR0","description":"","format":"","groups":"editors","install_time":"2024/04/16 00:00:00","item_id":"NIEDBTIQQW","location":"","multiarch":"null","name":"freebsd","priority":"optional","scan_time":"2023/12/1915:32:25","size":"15","source":"","vendor":"freebsd","version":"1.2"}, "operation": "INSERTED"} DEBUG:root:Syscollector Event - d:syscollector:{"type": "dbsync_packages", "data": {"architecture":"","checksum":"RFHJBQI02W","description":"","format":"","groups":"editors","install_time":"2024/04/16 00:00:00","item_id":"GE9QTLMTLB","location":"","multiarch":"null","name":"freebsd","priority":"optional","scan_time":"2023/12/1915:32:25","size":"16","source":"","vendor":"freebsd","version":"2.0"}, "operation": "INSERTED"} DEBUG:root:Syscollector Event - d:syscollector:{"type": "dbsync_packages", "data": {"architecture":"","checksum":"2T3GKWEFYA","description":"","format":"","groups":"editors","install_time":"2024/04/16 00:00:00","item_id":"PP6SFXDY99","location":"","multiarch":"null","name":"freebsd","priority":"optional","scan_time":"2023/12/1915:32:25","size":"17","source":"","vendor":"freebsd","version":"2.0.1"}, "operation": "INSERTED"} DEBUG:root:Syscollector Event - d:syscollector:{"type": "dbsync_packages", "data": {"architecture":"","checksum":"OUK3Y8J2X6","description":"","format":"","groups":"editors","install_time":"2024/04/16 00:00:00","item_id":"ZTL1LTPNNF","location":"","multiarch":"null","name":"freebsd","priority":"optional","scan_time":"2023/12/1915:32:25","size":"18","source":"","vendor":"freebsd","version":"2.0.5"}, "operation": "INSERTED"} DEBUG:root:Syscollector Event - d:syscollector:{"type": "dbsync_packages", "data": {"architecture":"","checksum":"N9UVIWXA0W","description":"","format":"","groups":"editors","install_time":"2024/04/16 00:00:00","item_id":"VTHFBH0IP2","location":"","multiarch":"null","name":"freebsd","priority":"optional","scan_time":"2023/12/1915:32:25","size":"19","source":"","vendor":"freebsd","version":"2.1.5"}, "operation": "INSERTED"} DEBUG:root:Syscollector Event - d:syscollector:{"type": "dbsync_packages", "data": {"architecture":"","checksum":"D703LQDFV2","description":"","format":"","groups":"editors","install_time":"2024/04/16 00:00:00","item_id":"WW1V8NDJJK","location":"","multiarch":"null","name":"freebsd","priority":"optional","scan_time":"2023/12/1915:32:25","size":"20","source":"","vendor":"freebsd","version":"2.1.6"}, "operation": "INSERTED"} ```
Ossec Logs 🟢
```console root@ubuntu2204:/home/vagrant# tail -f /var/ossec/logs/ossec.log 2024/04/16 09:53:32 wazuh-authd: INFO: New connection from 172.16.1.13 2024/04/16 09:53:32 wazuh-authd: INFO: Received request for a new agent (1-bpcFltYPL7Ud8wR0-debian10) from: 172.16.1.13 2024/04/16 09:53:32 wazuh-authd: INFO: Agent key generated for '1-bpcFltYPL7Ud8wR0-debian10' (requested by any) 2024/04/16 09:53:40 wazuh-remoted: INFO: (1409): Authentication file changed. Updating. 2024/04/16 09:53:40 wazuh-remoted: INFO: (1410): Reading authentication keys file. ```
Ossec Logs 🟢
```console root@ubuntu2204:/home/vagrant# tail -n 20 /var/ossec/logs/archives/archives.log 2024 Apr 16 09:53:57 (1-bpcFltYPL7Ud8wR0-debian10) any->vulnerability-detector {"vulnerability":{"assigner":"mitre","cve":"CVE-2001-0371","cvss":{"cvss2":{"base_score":6.2,"vector":{"access_complexity":"HIGH","authentication":"NONE","availability":"COMPLETE","confidentiality_impact":"COMPLETE","integrity_impact":"COMPLETE"}}},"cwe_reference":"","enumeration":"CVE","package":{"architecture":"","condition":"Package less than or equal to 4.2","name":"freebsd","source":"","version":"2.1.6"},"published":"2001-06-18T04:00:00Z","rationale":"Race condition in the UFS and EXT2FS file systems in FreeBSD 4.2 and earlier, and possibly other operating systems, makes deleted data available to user processes before it is zeroed out, which allows a local user to access otherwise restricted information.","reference":"http://archives.neohapsis.com/archives/freebsd/2001-03/0403.html, http://www.osvdb.org/5682, https://exchange.xforce.ibmcloud.com/vulnerabilities/6268","severity":"Medium","status":"Active","title":"CVE-2001-0371 affects freebsd","type":"Packages","updated":"2017-10-10T01:29:42Z"}} 2024 Apr 16 09:53:57 (1-bpcFltYPL7Ud8wR0-debian10) any->vulnerability-detector {"vulnerability":{"assigner":"mitre","cve":"CVE-2019-6111","cvss":{"cvss2":{"base_score":5.8,"vector":{"access_complexity":"MEDIUM","authentication":"NONE","availability":"PARTIAL","confidentiality_impact":"NONE","integrity_impact":"PARTIAL"}}},"cwe_reference":"CWE-22","enumeration":"CVE","package":{"architecture":"","condition":"Package less than 12.0","name":"freebsd","source":"","version":"2.1.6"},"published":"2019-01-31T18:29:00Z","rationale":"An issue was discovered in OpenSSH 7.9. Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the scp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious scp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the scp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file).","reference":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00058.html, http://www.securityfocus.com/bid/106741, https://bugzilla.redhat.com/show_bug.cgi?id=1677794, https://www.exploit-db.com/exploits/46193/, http://www.openwall.com/lists/oss-security/2019/04/18/1, http://www.openwall.com/lists/oss-security/2022/08/02/1, https://lists.debian.org/debian-lts-announce/2019/03/msg00030.html, https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html, https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c, https://access.redhat.com/errata/RHSA-2019:3702, https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf, https://security.gentoo.org/glsa/201903-16, https://security.netapp.com/advisory/ntap-20190213-0001/, https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt, https://usn.ubuntu.com/3885-1/, https://usn.ubuntu.com/3885-2/, https://www.debian.org/security/2019/dsa-4387, https://www.freebsd.org/security/advisories/FreeBSD-EN-19:10.scp.asc, https://lists.apache.org/thread.html/c45d9bc90700354b58fb7455962873c44229841880dcb64842fa7d23%40%3Cdev.mina.apache.org%3E, https://lists.apache.org/thread.html/c7301cab36a86825359e1b725fc40304d1df56dc6d107c1fe885148b%40%3Cdev.mina.apache.org%3E, https://lists.apache.org/thread.html/d540139359de999b0f1c87d05b715be4d7d4bec771e1ae55153c5c7a%40%3Cdev.mina.apache.org%3E, https://lists.apache.org/thread.html/e47597433b351d6e01a5d68d610b4ba195743def9730e49561e8cf3f%40%3Cdev.mina.apache.org%3E, https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W3YVQ2BPTOVDCFDVNC2GGF5P5ISFG37G/","severity":"Medium","status":"Active","title":"CVE-2019-6111 affects freebsd","type":"Packages","updated":"2023-11-07T03:13:05Z"}} 2024 Apr 16 09:53:57 (1-bpcFltYPL7Ud8wR0-debian10) any->vulnerability-detector {"vulnerability":{"assigner":"mitre","cve":"CVE-1999-1518","cvss":{"cvss2":{"base_score":5.0,"vector":{"access_complexity":"LOW","authentication":"NONE","availability":"PARTIAL","confidentiality_impact":"NONE","integrity_impact":"NONE"}}},"cwe_reference":"","enumeration":"CVE","package":{"architecture":"","condition":"Package equal to 2.1.6","name":"freebsd","source":"","version":"2.1.6"},"published":"1999-07-15T04:00:00Z","rationale":"Operating systems with shared memory implementations based on BSD 4.4 code allow a user to conduct a denial of service and bypass memory limits (e.g., as specified with rlimits) using mmap or shmget to allocate memory and cause page faults.","reference":"http://www.securityfocus.com/bid/526, http://marc.info/?l=bugtraq&m=93207728118694&w=2, https://exchange.xforce.ibmcloud.com/vulnerabilities/2351","severity":"Medium","status":"Active","title":"CVE-1999-1518 affects freebsd","type":"Packages","updated":"2017-12-19T02:29:09Z"}} 2024 Apr 16 09:53:57 (1-bpcFltYPL7Ud8wR0-debian10) any->vulnerability-detector {"vulnerability":{"assigner":"freebsd","cve":"CVE-2006-1283","cvss":{"cvss2":{"base_score":7.2,"vector":{"access_complexity":"LOW","authentication":"NONE","availability":"COMPLETE","confidentiality_impact":"COMPLETE","integrity_impact":"COMPLETE"}}},"cwe_reference":"","enumeration":"CVE","package":{"architecture":"","condition":"Package equal to 2.1.6","name":"freebsd","source":"","version":"2.1.6"},"published":"2006-03-23T20:06:00Z","rationale":"opiepasswd in One-Time Passwords in Everything (OPIE) in FreeBSD 4.10-RELEASE-p22 through 6.1-STABLE before 20060322 uses the getlogin function to determine the invoking user account, which might allow local users to configure OPIE access to the root account and possibly gain root privileges if a root shell is permitted by the configuration of the wheel group or sshd.","reference":"http://www.securityfocus.com/bid/17194, ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-06:12.opie.asc, http://secunia.com/advisories/19347, http://www.vupen.com/english/advisories/2006/1074, http://securitytracker.com/id?1015817, http://www.osvdb.org/24067, https://exchange.xforce.ibmcloud.com/vulnerabilities/25397","severity":"High","status":"Active","title":"CVE-2006-1283 affects freebsd","type":"Packages","updated":"2017-07-20T01:30:27Z"}} 2024 Apr 16 09:53:57 (1-bpcFltYPL7Ud8wR0-debian10) any->vulnerability-detector {"vulnerability":{"assigner":"mitre","cve":"CVE-2000-0461","cvss":{"cvss2":{"base_score":2.1,"vector":{"access_complexity":"LOW","authentication":"NONE","availability":"PARTIAL","confidentiality_impact":"NONE","integrity_impact":"NONE"}}},"cwe_reference":"","enumeration":"CVE","package":{"architecture":"","condition":"Package equal to 2.1.6","name":"freebsd","source":"","version":"2.1.6"},"published":"2000-05-29T04:00:00Z","rationale":"The undocumented semconfig system call in BSD freezes the state of semaphores, which allows local users to cause a denial of service of the semaphore system by using the semconfig call.","reference":"ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-00:19.semconfig.asc, ftp://ftp.netbsd.org/pub/NetBSD/misc/security/advisories/NetBSD-SA2000-004.txt.asc, http://www.openbsd.org/errata26.html#semconfig, http://www.securityfocus.com/bid/1270","severity":"Low","status":"Active","title":"CVE-2000-0461 affects freebsd","type":"Packages","updated":"2008-09-10T19:04:43Z"}} 2024 Apr 16 09:53:57 (1-bpcFltYPL7Ud8wR0-debian10) any->vulnerability-detector {"vulnerability":{"assigner":"mitre","cve":"CVE-2005-0109","cvss":{"cvss2":{"base_score":4.7,"vector":{"access_complexity":"MEDIUM","authentication":"NONE","availability":"NONE","confidentiality_impact":"COMPLETE","integrity_impact":"NONE"}}},"cwe_reference":"","enumeration":"CVE","package":{"architecture":"","condition":"Package equal to 2.1.6","name":"freebsd","source":"","version":"2.1.6"},"published":"2005-03-05T05:00:00Z","rationale":"Hyper-Threading technology, as used in FreeBSD and other operating systems that are run on Intel Pentium and other processors, allows local users to use a malicious thread to create covert channels, monitor the execution of other threads, and obtain sensitive information such as cryptographic keys, via a timing attack on memory cache misses.","reference":"http://www-1.ibm.com/support/docview.wss?uid=isg1SSRVHMCHMC_C081516_754, http://marc.info/?l=freebsd-hackers&m=110994026421858&w=2, http://marc.info/?l=freebsd-security&m=110994370429609&w=2, http://marc.info/?l=openbsd-misc&m=110995101417256&w=2, http://www.redhat.com/support/errata/RHSA-2005-476.html, http://www.redhat.com/support/errata/RHSA-2005-800.html, http://securitytracker.com/id?1013967, http://www.securityfocus.com/bid/12724, http://secunia.com/advisories/15348, http://secunia.com/advisories/18165, http://www.vupen.com/english/advisories/2005/0540, http://www.vupen.com/english/advisories/2005/3002, ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.24/SCOSA-2005.24.txt, http://www.daemonology.net/hyperthreading-considered-harmful/, http://www.daemonology.net/papers/htt.pdf, https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9747, http://www.kb.cert.org/vuls/id/911878, http://sunsolve.sun.com/search/document.do?assetkey=1-26-101739-1","severity":"Medium","status":"Active","title":"CVE-2005-0109 affects freebsd","type":"Packages","updated":"2018-10-16T12:06:26Z"}} 2024 Apr 16 09:53:57 (1-bpcFltYPL7Ud8wR0-debian10) any->vulnerability-detector {"vulnerability":{"assigner":"certcc","cve":"CVE-2005-0356","cvss":{"cvss2":{"base_score":5.0,"vector":{"access_complexity":"LOW","authentication":"NONE","availability":"PARTIAL","confidentiality_impact":"NONE","integrity_impact":"NONE"}}},"cwe_reference":"","enumeration":"CVE","package":{"architecture":"","condition":"Package equal to 2.1.6","name":"freebsd","source":"","version":"2.1.6"},"published":"2005-05-31T04:00:00Z","rationale":"Multiple TCP implementations with Protection Against Wrapped Sequence Numbers (PAWS) with the timestamps option enabled allow remote attackers to cause a denial of service (connection loss) via a spoofed packet with a large timer value, which causes the host to discard later packets because they appear to be too old.","reference":"http://www.securityfocus.com/bid/13676, http://secunia.com/advisories/15417/, http://www.kb.cert.org/vuls/id/637934, http://www.cisco.com/warp/public/707/cisco-sn-20050518-tcpts.shtml, ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-05:15.tcp.asc, ftp://ftp.sco.com/pub/updates/UnixWare/SCOSA-2005.64/SCOSA-2005.64.txt, http://secunia.com/advisories/15393, http://secunia.com/advisories/18222, http://secunia.com/advisories/18662, http://support.avaya.com/elmodocs2/security/ASA-2006-032.htm, https://exchange.xforce.ibmcloud.com/vulnerabilities/20635","severity":"Medium","status":"Active","title":"CVE-2005-0356 affects freebsd","type":"Packages","updated":"2019-04-30T14:27:13Z"}} 2024 Apr 16 09:53:57 (1-bpcFltYPL7Ud8wR0-debian10) any->vulnerability-detector {"vulnerability":{"assigner":"mitre","cve":"CVE-2012-5365","cvss":{"cvss2":{"base_score":7.8,"vector":{"access_complexity":"LOW","authentication":"NONE","availability":"COMPLETE","confidentiality_impact":"NONE","integrity_impact":"NONE"}}},"cwe_reference":"CWE-400","enumeration":"CVE","package":{"architecture":"","condition":"Package less than 9.2","name":"freebsd","source":"","version":"2.1.6"},"published":"2020-02-20T15:15:11Z","rationale":"The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICMPv6 Router Advertisement packets containing multiple Routing entries.","reference":"http://www.openwall.com/lists/oss-security/2012/10/10/12, https://www.securityfocus.com/bid/56170/info","severity":"High","status":"Active","title":"CVE-2012-5365 affects freebsd","type":"Packages","updated":"2020-02-25T19:30:04Z"}} 2024 Apr 16 09:53:57 (1-bpcFltYPL7Ud8wR0-debian10) any->vulnerability-detector {"vulnerability":{"assigner":"mitre","cve":"CVE-1999-1385","cvss":{"cvss2":{"base_score":7.2,"vector":{"access_complexity":"LOW","authentication":"NONE","availability":"COMPLETE","confidentiality_impact":"COMPLETE","integrity_impact":"COMPLETE"}}},"cwe_reference":"","enumeration":"CVE","package":{"architecture":"","condition":"Package equal to 2.1.6","name":"freebsd","source":"","version":"2.1.6"},"published":"1996-12-19T05:00:00Z","rationale":"Buffer overflow in ppp program in FreeBSD 2.1 and earlier allows local users to gain privileges via a long HOME environment variable.","reference":"ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/old/FreeBSD-SA-96:20.stack-overflow.asc, http://marc.info/?l=bugtraq&m=87602167420332&w=2, http://www.iss.net/security_center/static/7465.php, http://www.osvdb.org/6085","severity":"High","status":"Active","title":"CVE-1999-1385 affects freebsd","type":"Packages","updated":"2016-10-18T02:03:54Z"}} 2024 Apr 16 09:53:57 (1-bpcFltYPL7Ud8wR0-debian10) any->vulnerability-detector {"vulnerability":{"assigner":"mitre","cve":"CVE-1999-0130","cvss":{"cvss2":{"base_score":7.2,"vector":{"access_complexity":"LOW","authentication":"NONE","availability":"COMPLETE","confidentiality_impact":"COMPLETE","integrity_impact":"COMPLETE"}}},"cwe_reference":"","enumeration":"CVE","package":{"architecture":"","condition":"Package equal to 2.1.6","name":"freebsd","source":"","version":"2.1.6"},"published":"1996-11-16T05:00:00Z","rationale":"Local users can start Sendmail in daemon mode and gain root privileges.","reference":"http://www.securityfocus.com/bid/716","severity":"High","status":"Active","title":"CVE-1999-0130 affects freebsd","type":"Packages","updated":"2008-09-09T12:33:49Z"}} 2024 Apr 16 09:53:57 (1-bpcFltYPL7Ud8wR0-debian10) any->vulnerability-detector {"vulnerability":{"assigner":"mitre","cve":"CVE-1999-1298","cvss":{"cvss2":{"base_score":7.5,"vector":{"access_complexity":"LOW","authentication":"NONE","availability":"PARTIAL","confidentiality_impact":"PARTIAL","integrity_impact":"PARTIAL"}}},"cwe_reference":"","enumeration":"CVE","package":{"architecture":"","condition":"Package less than or equal to 2.2.1","name":"freebsd","source":"","version":"2.1.6"},"published":"1997-04-07T04:00:00Z","rationale":"Sysinstall in FreeBSD 2.2.1 and earlier, when configuring anonymous FTP, creates the ftp user without a password and with /bin/date as the shell, which could allow attackers to gain access to certain system resources.","reference":"ftp://ftp.FreeBSD.org/pub/FreeBSD/CERT/advisories/old/FreeBSD-SA-97:03.sysinstall.asc, http://www.iss.net/security_center/static/7537.php, http://www.osvdb.org/6087","severity":"High","status":"Active","title":"CVE-1999-1298 affects freebsd","type":"Packages","updated":"2008-09-10T19:01:40Z"}} 2024 Apr 16 09:53:57 (1-bpcFltYPL7Ud8wR0-debian10) any->vulnerability-detector {"vulnerability":{"assigner":"mitre","cve":"CVE-2006-4178","cvss":{"cvss2":{"base_score":4.9,"vector":{"access_complexity":"LOW","authentication":"NONE","availability":"COMPLETE","confidentiality_impact":"NONE","integrity_impact":"NONE"}}},"cwe_reference":"","enumeration":"CVE","package":{"architecture":"","condition":"Package less than or equal to 5.5","name":"freebsd","source":"","version":"2.1.6"},"published":"2006-09-26T02:07:00Z","rationale":"Integer signedness error in the i386_set_ldt call in FreeBSD 5.5, and possibly earlier versions down to 5.2, allows local users to cause a denial of service (crash) via unspecified arguments that use negative signed integers to cause the bzero function to be called with a large length parameter, a different vulnerability than CVE-2006-4172.","reference":"http://www.idefense.com/intelligence/vulnerabilities/display.php?id=415, http://secunia.com/advisories/22064, http://securitytracker.com/id?1016927, http://www.securityfocus.com/archive/1/446946/100/0/threaded, http://www.securityfocus.com/bid/20158","severity":"Medium","status":"Active","title":"CVE-2006-4178 affects freebsd","type":"Packages","updated":"2018-10-17T21:33:50Z"}} 2024 Apr 16 09:53:57 (1-bpcFltYPL7Ud8wR0-debian10) any->vulnerability-detector {"vulnerability":{"assigner":"mitre","cve":"CVE-1999-0513","cvss":{"cvss2":{"base_score":5.0,"vector":{"access_complexity":"LOW","authentication":"NONE","availability":"PARTIAL","confidentiality_impact":"NONE","integrity_impact":"NONE"}}},"cwe_reference":"","enumeration":"CVE","package":{"architecture":"","condition":"Package equal to 2.1.6","name":"freebsd","source":"","version":"2.1.6"},"published":"1998-01-05T05:00:00Z","rationale":"ICMP messages to broadcast addresses are allowed, allowing for a Smurf attack that can cause a denial of service.","reference":"https://exchange.xforce.ibmcloud.com/vulnerabilities/CVE-1999-0513","severity":"Medium","status":"Active","title":"CVE-1999-0513 affects freebsd","type":"Packages","updated":"2022-08-17T08:15:13Z"}} 2024 Apr 16 09:53:57 (1-bpcFltYPL7Ud8wR0-debian10) any->vulnerability-detector {"vulnerability":{"assigner":"mitre","cve":"CVE-2002-0829","cvss":{"cvss2":{"base_score":4.6,"vector":{"access_complexity":"LOW","authentication":"NONE","availability":"PARTIAL","confidentiality_impact":"PARTIAL","integrity_impact":"PARTIAL"}}},"cwe_reference":"","enumeration":"CVE","package":{"architecture":"","condition":"Package less than or equal to 4.6.1","name":"freebsd","source":"","version":"2.1.6"},"published":"2002-08-12T04:00:00Z","rationale":"Integer overflow in the Berkeley Fast File System (FFS) in FreeBSD 4.6.1 RELEASE-p4 and earlier allows local users to access arbitrary file contents within FFS to gain privileges by creating a file that is larger than allowed by the virtual memory system.","reference":"http://marc.info/?l=bugtraq&m=102865404413458&w=2, http://www.iss.net/security_center/static/9771.php, http://www.osvdb.org/5073, http://www.securityfocus.com/bid/5399","severity":"Medium","status":"Active","title":"CVE-2002-0829 affects freebsd","type":"Packages","updated":"2016-10-18T02:22:13Z"}} 2024 Apr 16 09:53:57 (1-bpcFltYPL7Ud8wR0-debian10) any->vulnerability-detector {"vulnerability":{"assigner":"mitre","cve":"CVE-2001-0469","cvss":{"cvss2":{"base_score":5.0,"vector":{"access_complexity":"LOW","authentication":"NONE","availability":"PARTIAL","confidentiality_impact":"NONE","integrity_impact":"NONE"}}},"cwe_reference":"","enumeration":"CVE","package":{"architecture":"","condition":"Package less than or equal to 4.2","name":"freebsd","source":"","version":"2.1.6"},"published":"2001-06-27T04:00:00Z","rationale":"rwho daemon rwhod in FreeBSD 4.2 and earlier, and possibly other operating systems, allows remote attackers to cause a denial of service via malformed packets with a short length.","reference":"http://archives.neohapsis.com/archives/freebsd/2001-03/0163.html, http://www.securityfocus.com/bid/2473, https://exchange.xforce.ibmcloud.com/vulnerabilities/6229","severity":"Medium","status":"Active","title":"CVE-2001-0469 affects freebsd","type":"Packages","updated":"2017-10-10T01:29:44Z"}} 2024 Apr 16 09:54:37 (1-lHQwmnSBv5NdeV6c-debian10) any->wazuh-monitord ossec: Agent disconnected: '1-lHQwmnSBv5NdeV6c-debian10-any'. 2024 Apr 16 09:54:37 (1-Dl97vxoJZYh1zA8M-debian10) any->wazuh-monitord ossec: Agent disconnected: '1-Dl97vxoJZYh1zA8M-debian10-any'. 2024 Apr 16 09:55:02 ubuntu2204->/var/log/auth.log Apr 16 09:55:01 ubuntu2204 CRON[8193]: pam_unix(cron:session): session closed for user root 2024 Apr 16 09:55:02 ubuntu2204->/var/log/syslog Apr 16 09:55:01 ubuntu2204 CRON[8194]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1) 2024 Apr 16 09:55:02 ubuntu2204->/var/log/auth.log Apr 16 09:55:01 ubuntu2204 CRON[8193]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0) ```
Database 🟢
```console root@ubuntu2204:/var/ossec/queue/db# sqlite3 021.db SQLite version 3.37.2 2022-01-06 13:25:41 Enter ".help" for usage hints. sqlite> SELECT * FROM sys_osinfo; 0|2023/12/2011:24:58|1-bpcFltYPL7Ud8wR0-debian10|x86_64|Ubuntu|20.04.6LTS(FocalFossa)|focal|20|04|6|4.18.0-305.12.1.el8_4.x86_64|ubuntu|Linux|6.2.6-76060206-generic|#202303130630~1689015125~22.04~ab2190eSMPPREEMPT_DYNAMIC|sp1|1634140017886803554|| sqlite> ```
Description
When using
simulate-agentsto generate Syscollector packages, you have to also send the OS info. If it is not sent, vulnerabilities are not generated and errors such asTo avoid this, when package events (and only packages) are generated, an osinfo event is also added to send the necessary OS information.
Testing Performed
The tests have been passed locally. To test the changes you have to use the
simulate-agentswith the following commandsimulate-agents -a xxx.xx.x.xx -n 1 -m syscollector -s 5 -t 12 -o debian10 -v 4.8.0 --debugand check that no errors appear and all expected messages are generated.