Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CPE Updates #267

Merged
merged 4 commits into from
Jun 3, 2020
Merged

CPE Updates #267

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2628ef5
Fixup: Normalize descriptions
tsellers-r7 May 27, 2020
72f9f69
Update CPEs
tsellers-r7 May 27, 2020
718b8b8
Address Netscaler OS
tsellers-r7 Jun 3, 2020
f7a4f62
MySQL: add some debian matches
tsellers-r7 Jun 3, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,9 @@ pkg/

/Gemfile.lock

#Python specific
venv

# IDE specific
.vscode/
.idea
Expand Down
21 changes: 21 additions & 0 deletions cpe-remap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,6 @@
mappings:
alpine:
vendor: aplinelinux
tsellers-r7 marked this conversation as resolved.
Show resolved Hide resolved
apache:
vendor: apache
products:
Expand Down Expand Up @@ -45,10 +47,17 @@ mappings:
vendor: ibm
products:
lotus_domino: lotus_domino_server
os/400: os_400
z/os: z\/os
jamf:
products:
jamf_pro: jamf
juniper:
vendor: juniper
products:
junos_os: junos
kibana:
vendor: elasticsearch
linux:
vendor: linux
products:
Expand Down Expand Up @@ -94,6 +103,11 @@ mappings:
vendor: paloaltonetworks
products:
pa_firewall: pan-os
parallels:
products:
plesk: parallels_plesk_panel
plesk:
vendor: parallels
proftpd_project:
vendor: proftpd
realvnc_ltd.:
Expand All @@ -113,6 +127,13 @@ mappings:
vendor: sun
products:
solaris: sunos
tandberg:
vendor: cisco
tightvnc:
products:
desktop: tightvnc
ubiquiti:
vendor: ui
ubuntu:
vendor: canonical
products:
Expand Down
2 changes: 1 addition & 1 deletion update_cpes.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@ def update_cpes(xml_file, cpe_vp_map, r7_vp_map):
if not fp_type in params:
params[fp_type] = {}
if name in params[fp_type]:
raise ValueError('Duplicated fingerprint named {} in {}'.format(name, fingerprint.attrib['pattern']))
raise ValueError('Duplicated fingerprint named {} in fingerprint {} in file {}'.format(name, fingerprint.attrib['pattern'], xml_file))
params[fp_type][name] = param


Expand Down
20 changes: 9 additions & 11 deletions xml/dns_versionbind.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,7 +154,7 @@
<param pos="0" name="os.product" value="Zentyal"/>
</fingerprint>
<fingerprint pattern="^(9.[^-]+(?:-[SP]\d)?)-9\+deb8u[\w~\.]+-Debian$">
<description>ISC BIND: Debian Jessie</description>
<description>ISC BIND: Debian 8.0 (jessie)</description>
<example service.version="9.9.5">9.9.5-9+deb8u11-Debian</example>
<example service.version="9.9.5">9.9.5-9+deb8u6A~4.2.0.201702281603-Debian</example>
<param pos="0" name="service.vendor" value="ISC"/>
Expand All @@ -169,7 +169,7 @@
<param pos="0" name="os.cpe23" value="cpe:/o:debian:debian_linux:8.0"/>
</fingerprint>
<fingerprint pattern="^(9.[^-]+(?:-[SP]\d)?)-9wheezy\w+-Debian$">
<description>ISC BIND: Debian Wheezy</description>
<description>ISC BIND: Debian 7.0 (wheezy)</description>
<example service.version="9.9.5">9.9.5-9wheezy1-Debian</example>
<param pos="0" name="service.vendor" value="ISC"/>
<param pos="0" name="service.family" value="BIND"/>
Expand Down Expand Up @@ -403,7 +403,7 @@
</fingerprint>
<fingerprint pattern="^Nominum Vantio ([\d.]+) \(build (\d+)\)$">
<description>Nominum Vantio CacheServe, with build</description>
<example service.version.version="114872">Nominum Vantio 5.4.5.1 (build 114872)</example>
<example service.version="5.4.5.1" service.version.version="114872">Nominum Vantio 5.4.5.1 (build 114872)</example>
<param pos="0" name="service.vendor" value="Nominum"/>
<param pos="0" name="service.family" value="Vantio"/>
<param pos="0" name="service.product" value="CacheServe"/>
Expand Down Expand Up @@ -734,14 +734,12 @@
</fingerprint>
<fingerprint pattern="^dnsmasq-pi-hole-(.*)$">
<description>dnsmasq: pi-hole</description>
<example os.vendor="Pi-hole" service.vendor="Thekelleys" service.family="Dnsmasq" service.product="Dnsmasq" os.version="2.80" os.cpe23="cpe:/a:pi-hole:pi-hole:2.80" service.cpe23="cpe:/a:thekelleys:dnsmasq:-">dnsmasq-pi-hole-2.80</example>
<param pos="0" name="os.vendor" value="Pi-hole"/>
<param pos="0" name="service.vendor" value="Thekelleys"/>
<param pos="0" name="service.family" value="Dnsmasq"/>
<param pos="0" name="service.product" value="Dnsmasq"/>
<param pos="1" name="os.version"/>
<param pos="0" name="os.cpe23" value="cpe:/a:pi-hole:pi-hole:{os.version}"/>
<param pos="0" name="service.cpe23" value="cpe:/a:thekelleys:dnsmasq:-"/>
<example service.version="2.80">dnsmasq-pi-hole-2.80</example>
<param pos="0" name="service.vendor" value="Pi-hole"/>
tsellers-r7 marked this conversation as resolved.
Show resolved Hide resolved
<param pos="0" name="service.family" value="Pi-hole"/>
<param pos="0" name="service.product" value="Pi-hole"/>
<param pos="1" name="service.version"/>
<param pos="0" name="service.cpe23" value="cpe:/a:pi-hole:pi-hole:{service.version}"/>
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FYI @brudis-r7 - This fingerprint has changed quite a bit.

</fingerprint>
<fingerprint pattern="^Q9-[^\-]-(.*)$">
<description>Quad9 Resolver</description>
Expand Down
11 changes: 6 additions & 5 deletions xml/ftp_banners.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -323,6 +323,7 @@ example.com FTP server (Version: Mac OS X Server) ready.</example>
<param pos="0" name="service.vendor" value="ProFTPD Project"/>
<param pos="0" name="service.product" value="ProFTPD"/>
<param pos="1" name="service.version"/>
<param pos="0" name="service.cpe23" value="cpe:/a:proftpd:proftpd:{service.version}"/>
<param pos="2" name="host.name"/>
</fingerprint>
<fingerprint pattern="^=\(&lt;\*&gt;\)=-\.:\. \(\( Welcome to Pure-FTPd ([\d.]+) \)\) \.:\.-=\(&lt;\*&gt;\)=-" flags="REG_MULTILINE">
Expand Down Expand Up @@ -763,23 +764,23 @@ more text</example>
<param pos="0" name="os.vendor" value="Wind River"/>
<param pos="0" name="os.product" value="VxWorks"/>
<param pos="1" name="os.version"/>
<param pos="0" name="os.cpe23" value="cpe:/o:windriver:vxworks:-{os.version}"/>
<param pos="0" name="os.cpe23" value="cpe:/o:windriver:vxworks:{os.version}"/>
</fingerprint>
<fingerprint pattern="^[\w&lt;&gt;]+\s*Tenor Multipath Switch FTP server \(Version VxWorks([\d\.]+)\) ready\.$" flags="REG_ICASE">
<description>VxWorks on Tenor MultiPath with version information</description>
<example os.version="5.4.2"><![CDATA[<38785ca0> Tenor Multipath Switch FTP server (Version VxWorks5.4.2) ready.]]></example>
<example os.version="5.4.2">&lt;38785ca0&gt; Tenor Multipath Switch FTP server (Version VxWorks5.4.2) ready.</example>
<param pos="0" name="os.vendor" value="Wind River"/>
<param pos="0" name="os.product" value="VxWorks"/>
<param pos="1" name="os.version"/>
<param pos="0" name="os.cpe23" value="cpe:/o:windriver:vxworks:-{os.version}"/>
<param pos="0" name="os.cpe23" value="cpe:/o:windriver:vxworks:{os.version}"/>
</fingerprint>
<fingerprint pattern="^VxWorks FTP server \(VxWorks ([\d\.]+) - Secure NetLinx version \([\d\.]+\)\) ready.$">
<description>VxWorks with Secure NetLinx</description>
<example os.version="5.3.1">VxWorks FTP server (VxWorks 5.3.1 - Secure NetLinx version (1.0)) ready.</example>
<param pos="0" name="os.vendor" value="Wind River"/>
<param pos="0" name="os.product" value="VxWorks"/>
<param pos="1" name="os.version"/>
<param pos="0" name="os.cpe23" value="cpe:/o:windriver:vxworks:-{os.version}"/>
<param pos="0" name="os.cpe23" value="cpe:/o:windriver:vxworks:{os.version}"/>
</fingerprint>
<fingerprint pattern="^ADC iScale$">
<description>ADC iScale</description>
Expand Down Expand Up @@ -1549,5 +1550,5 @@ more text</example>
<param pos="0" name="hw.product" value="Home Controller"/>
<param pos="0" name="os.vendor" value="ELAN"/>
<param pos="0" name="os.family" value="Linux"/>
</fingerprint>
</fingerprint>
</fingerprints>
Loading