cpe_helper alternative in Wazuh 4.8+

[John]

Hello!

What's current way of extending detection capabilities of Wazuh 4.8+?

I see software in Inventory of Windows Servers that is definetely vulnerable, but wazuh is not reporing it.

[Victor Carlos Erenu]

Hello John

We don't have Extending Detection Capabilities with Vulnerability Detection in Wazuh 4.8+, but we can check which vulnerability it doesn't detect to see if we have any problems with the detection.
Could you tell me what software you have with vulnerabilities, its version and which CVE is the one that Wazuh is not detecting?

It should be noted that Wazuh compares the data of your software with our database to detect which installed software has declared vulnerabilities:
https://documentation.wazuh.com/current/compliance/nist/vulnerability-detection.html

Regards

[John]

Got it. Let's start with this example:

CVEs at NVD: https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&isCpeNameSearch=true&seach_type=all&query=cpe:2.3:a:7-zip:7-zip:19.00:*:*:*:*:*:*:*

[Isaiah Daboh]

Hello,

I have created an issue to further analyze this and fix the CVEs accordingly.

However, CVE-2023-31102 according to NVD, does not affect your host since the expected platform is Linux. CVE-2022-29072 will be investigated and you should be able to track the issue https://github.com/wazuh/wazuh/issues/26595.

Regards,

[Openime Oniagbi]

Hello John,

We have resolved the issues with CVE-2022-29072 and CVE-2023-31102, and both updates should be available from tomorrow. All you need to do is restart the Wazuh manager to force the feed update and rescan the affected endpoints. If you have any other CVEs like this, please report them so we can resolve them as quickly as possible. Thank you.

[John]

I can confirm that CVE-2022-29072 is now reported correctly on Windows machine. Thank you for the fix!

I'll post other findings, but not just now.

[j885...@gmail.com]

New findings. These software packages are detected by Wazuh Inventory but corresponding CVEs are not:

1)

Package Name: Adobe Reader 9.1 - Russian

Package Version: 9.1.0

Package Vendor: Adobe Systems Incorporated

CVEs that should be matched

2)

Package Name: Adobe Acrobat XI Standard

Package Version: 11.0.23

Package Vendor: Adobe Systems

CVEs that should be matched

Similarly the following are not matched to CVEs:

Package Name: Adobe Reader XI (11.0.11) - Russian

Package Version: 11.0.11

Package Vendor: Adobe Systems Incorporated

Package Name: Adobe Reader XI (11.0.12) - Russian

Package Version: 10.1.0

Package Vendor: Adobe Systems Incorporated

Package Name: Adobe Reader XI (11.0.23) - Russian

Package Version: 11.0.23

Package Vendor: Adobe Systems Incorporated

Package Name: Adobe Reader X (10.1.0) - Russian

Package Version: 10.1.0

Package Vendor: Adobe Systems Incorporated

[j885...@gmail.com]

Also

Package Name: WinRAR 5.40 (64-bit)

Package Version: 5.40.0

Package Vendor: win.rar GmbH

CVEs that should be matched

[John Ackley]

Kind reminder