Headline
CVE-2021-44916: Release Notes for Open-AudIT v4.3.0 - Open-AudIT
Opmantek Open-AudIT Community 4.2.0 (Fixed in 4.3.0) is affected by a Cross Site Scripting (XSS) vulnerability. If a bad value is passed to the routine via a URL, malicious JavaScript code can be executed in the victim’s browser.
Released 2021-12-01
Linux SHA256 - 4c27c60e1f6ea96bbdf5a7f21fbc9d80ca2e2991091215d481fc1c6c60e3fc9a
Linux MD5 - 454316502bf423faa2336f8f5ad7f133
This release of Open-AudIT was bought forward because of the disclosure of two vulnerabilities.
This release fixes these issues.
The details of each can be found at:
- Errata - 4.2.0 and earlier Javascript vulnerability
- Errata - 4.2.0, 3.5.0 and onwards util function vulnerability
Version
Type
Collection
Description
Professional
Bug
Integrations
When multiple integrations are configured, multiple identical attributes would appear in the integrations details on the device details page.
Professional
New Feature
Discoveries
Retrieve and display installed certificates on Linux. Both system wide and Apache specific.
Professional
New Feature
Discoveries
Retrieve and display USB connected devices (exclude bluetooth on Windows).
Professional
Improvement
Queries
Add Query Details button to Query Execute template.
Community
Improvement
Discoveries
There was an issue with PHP’s SNMPv3 implementation. This is resolved for Linux where we now use net-snmp for initial credential testing. For Windows we cannot do this so the caveat is that where SNMPv3 is used, you must not have multiple credential sets (for SNMPv3) with identical security names.
Professional
Improvement
Licenses
Add a license expiry date to /licenses entries.
Professional
Improvement
Discoveries
Provide a list of discovery issues with hints to how to resolve them.
Professional
Bug
Discoveries
Fix Active Directory discovery type option. AD discoveries now work again.
Professional
Bug
Integrations
Fix integrations fields for bool_one_zero and bool_y_n always staying 'false’.
Professional
Improvement
Devices
Provide an indication on the Devices List screen to indicate level of audit performed.
Community
Bug
Util
Filter out all characters except those in the allowed list for determining number of IPs in range or subnet for util::subnet_size. See Errata - 4.2.0, 3.5.0 and onwards util function vulnerability
Community
Bug
All
Fix link creation to exclude user input. See Errata - 4.2.0 and earlier Javascript vulnerability
Community
Improvement
All
For spawning processes, no longer use the execute script with a URL, now call PHP directly. No longer a requirement for http to be available from localhost.
Community
Improvement
Util
Allow downloading test_windows_client.vbs using the web interface at util/test_windows_client.
Community
Improvement
Audit
Improvements to test_windows_client.vbs:
- checks for RPC and NetLogon services
- OS architecture
Community
Improvement
Discoveries
Fix audit_linux.sh to allow running on BusyBox.
Enterprise
Improvement
Clouds
Delete the associated discovery when we delete the cloud.
Community
Improvement
Discoveries
Update the MAC -> Manufacturer helper with more manufacturers.
Community
Improvement
Discoveries
Add Fortinet Fortigate models to SNMP Model Helper.
Community
Improvement
Discoveries
Detect Quest InTrust Agent in audit_linux.sh.
Community
Bug
Devices
Fix for image upload path traversal issue.
Community
Improvement
Devices
Automatically add to filter for oae_manage if request from Open-AudIT Enterprise on devices collection.
Community
Bug
Devices
Fix running multiple device discoveries from the Bulk Edit screen.
Community
Improvement
Discoveries
Make all command line calls from Linux (winexe, smbclient) use a credentials file, rather than put the credentials on the command line. All work in wmi_helper.
Community
Improvement
All
Update JS libraries for: jQuery Tablesorter, Bootstrap Table, Bootstrap FileStyle, Chartist.
Community
Improvement
Discoveries
More robust scp transfer test for success in ssh_helper.
Community
Improvement
Rules
Improve discovery logging in m_rules::execute.
Enterprise
Improvement
Collectors
When creating a discovery on a collector, include blank command_options and remove options so we’re SQL Strict compliant.
Professional
Improvement
Discoveries
Ensure the discovery export function retrieves all discovery logs.
Professional
Bug
Devices
Fix broken edit fields for Opmantek Details on devices read template for custom fields.
Professional
Improvement
All
Upgrade JS libraries for dataTables and HighCharts.
Professional
Improvement
Devices
On device details, only show discovery issues for the latest discovery.