vulnerable.bro error on check

fatal error in /opt/bro/share/bro/policy/frameworks/software/vulnerable.bro, line 41: BroType::AsRecordType (table/record) (set[record { min:record { major:count; minor:count; minor2:count; minor3:count; addl:string; }; max:record { major:count; minor:count; minor2:count; minor3:count; addl:string; }; }])

Not trying to hijack the thread, but ditto for me on the above message. I just updated to git master today after running an old version for a long time. Commenting out f/s/vulnerable in local.bro bypasses error.

The way vulnerable software is specified has changed to allow for more flexibility. Here's what my local.bro has, for example:

global java_1_6_vuln: Software::VulnerableVersionRange = [$max=[$major=1,$minor=6,$minor2=0,$minor3=44]];
global java_1_7_vuln: Software::VulnerableVersionRange = [$min=[$major=1,$minor=7], $max=[$major=1,$minor=7,$minor2=0,$minor3=20]];

redef Software::vulnerable_versions += {
        ["Java"] = set(java_1_6_vuln, java_1_7_vuln)

This defines any Java <= and any Java >= 1.7 and <= as vulnerable.


2.1-366 | 2013-03-17 12:35:59 -0700

   * Improvements to vulnerable software detection. (Seth Hall)
      - Add a DNS based updating method. This needs to be tested

      - Vulnerable version ranges are used now instead of only single
        versions. This can deal with software with multiple stable
        major versions.

   * Update software version parsing and comparison to account for a
     third numeric subversion. Also, $addl is now compared numerically
     if the value is actually numeric. (Seth Hall)

Is it safe to assume accounts didn't get ported over to the new Tracker?

See: <>, specifically:

The most significant thing users should note is that as part of the import in to JIRA, accounts have been created with the same usernames as were in Trac, however password resets need to be requested before they can be used to log in. This can be done by selecting the "Unable to access your account?" link from the log in screen to request password reset instructions via email.

Hope this helps,


Thanks Vlad, that got me past that error. I've run into a few more, but have been working through them. I may ask for some help converting my old scripts that were working with the bro 2.1 git repository from 11/2012.