mirror of
https://github.com/zeek/zeek.git
synced 2025-10-06 00:28:21 +00:00
b307cbbe64
- Scripts now use the full path for @load to remove the subpaths from the shipped BROPATH. - Some script sets have been reorganized to make optional loads more obvious.
28 lines
No EOL
710 B
Text
28 lines
No EOL
710 B
Text
@load frameworks/software
|
|
@load frameworks/notice
|
|
|
|
module Software;
|
|
|
|
export {
|
|
redef enum Notice::Type += {
|
|
Vulnerable_Version,
|
|
};
|
|
|
|
## This is a table of software versions indexed by the name of the
|
|
## software and yielding the latest version that is vulnerable.
|
|
const vulnerable_versions: table[string] of Version &redef;
|
|
}
|
|
|
|
redef vulnerable_versions += {
|
|
["Flash"] = [$major=10,$minor=2,$minor2=153,$addl="1"],
|
|
["Java"] = [$major=1,$minor=6,$minor2=0,$addl="22"],
|
|
};
|
|
|
|
event log_software(rec: Info)
|
|
{
|
|
if ( rec$name in vulnerable_versions &&
|
|
cmp_versions(rec$version, vulnerable_versions[rec$name]) <= 0 )
|
|
{
|
|
NOTICE([$note=Vulnerable_Version, $src=rec$host, $msg=software_fmt(rec)]);
|
|
}
|
|
} |