Menu

#273 Empty trustee_name for a sid_item

Version 5.10.1
open
None
5
2014-05-23
2014-05-22
Dragos P.
No

The latest version of ovaldi (5.10.1.7) creates an item with an empty trustee_name when the following object is collected:
<sid_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" id="oval:nist.validation.winSid:obj:1" version="1"> <behaviors include_group="true" resolve_group="true"/> <trustee_name operation="equals">Administrators</trustee_name> </sid_object>
Here is the excerpt from the SC:
<sid_item xmlns="http://oval.mitre.org/XMLSchema/oval-system-characteristics-5#windows" id="2"> <trustee_name/> <trustee_sid>S-1-5-32</trustee_sid> <trustee_domain>BUILTIN</trustee_domain> </sid_item>

Discussion

  • Michael Chisholm

    Fyi, I haven't been able to reproduce this with ovaldi built from tag Version5_10_1_B7. On my laptop, I get 9 items, which all seem correctly formed.

     
  • Dragos P.

    Dragos P. - 2014-05-23

    I am using the same build (5.10.1 Build: 7), but I'll see if it happens on other W7 systems. Thanks. _Dragos.

     

Log in to post a comment.