Repository navigation
clarify how to handle reg_multi_sz values with no values #61
Description
Activity
This has been deferred to OVAL 5.11 Draft 3.
This is universally true of any multi-valued entity. I will make a note of this in the specification, section 5.3.4.1.4.
- added a commit that references this issue
on Sep 8, 2016 I may be opening a can of worms here, but I am pretty sure that we (CIS) have a benchmark or two which recommend certain settings have an empty value, and those settings correspond to registry keys which are REG_MULTI_SZ's. Therefore our recommendation is that the registry key exists and contains an empty array of values. By the specification, the registry_item would then be created with a
<value status="does_not_exist">, and evaluation would then dictate that the item would fail. Using the "does_not_exist" status here doesn't seem to allow for an expected state of an empty array of values.But, that's precisely what it means! It means the value exists, and has a length of 0. (i.e., the raw value is \0\0).
i.e., such a state would look like this:
<registry_state> <key>something</key> <name>whatever</name> <type>reg_multi_sz</type> <value check_existence="does not exist"/> </registry_state>Where in this change is adding a
check_existenceto a state element?We added check_existence to state entities in either 5.11 or 5.11.1 (I don't recall which).
Ahh, so you did, in 5.11.1. Excellent, thanks!
We, Bill. We. :)
The OVAL Language Specification and schema documentation does not specify how to handle reg_multi_sz values with no values. Reg_multi_sz values, with no values, should be given a status of "does not exist".
Please see the following oval-developer-list for more information.
http://making-security-measurable.1364806.n2.nabble.com/The-case-of-the-empty-REG-MULTI-SZ-value-tp7302345.html