software.log

Zeek
1

John,

Have you looked at policy/frameworks/software/vulnerable.bro[1]? It seems like it implements what you're looking to do. For example, here's what I have in my local.bro:

@load frameworks/software/vulnerable
global java_1_6_vuln: Software::VulnerableVersionRange = [$max=[$major=1,$minor=6,$minor2=0,$minor3=48]];
global java_1_7_vuln: Software::VulnerableVersionRange = [$min=[$major=1,$minor=7], $max=[$major=1,$minor=7,$minor2=0,$minor3=22]];

redef Software::vulnerable_versions += {
        ["Java"] = set(java_1_6_vuln, java_1_7_vuln)
};

See also: https://github.com/bro/bro/blob/master/NEWS#L313

What this does is define two ranges of vulnerable Java versions. The first is anything prior to 1.6.0.48 (including 1.5, 1.4, etc.). The second is anything between 1.7.0.0 and 1.7.0.22.

Of course, if you only care about 1.7.0.40, you can just define that as the min/max.

Does that help? Or was that not the functionality you were looking for?

  --Vlad

[1] - <https://github.com/bro/bro/blob/master/scripts/policy/frameworks/software/vulnerable.bro&gt;

2

Yes This is exactly what I was looking for. I just didn¹t know how to go
about it. Thank you Vlad!

3

Care to send it to the list? I'd like to see it myself...thank you.

James