valitydev/osquery-1
14
0
Fork 0
mirror of https://github.com/valitydev/osquery-1.git synced 2024-11-07 01:55:20 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add unauthenticated sparkle feeds query to vuln-mgmt pack

Browse Source
This commit is contained in:
Teddy Reed 2016-02-01 12:51:36 -08:00
parent 52c8b17650
commit 581e2213de
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
packs/vuln-management.conf
View File

@ -109,6 +109,14 @@
"version" : "1.4.5",
"description" : "Retrieves all the installed RPM packages in the target Linux system.",
"value" : "This, with the help of vulnerability feed, can help tell if a vulnerable application is installed."
},
"unauthenticated_sparkle_feeds": {
"query" : "select feeds.*, p2.value as sparkle_version from (select a.name as app_name, a.path as app_path, a.bundle_identifier as bundle_id, p.value as feed_url from (select name, path, bundle_identifier from apps) a, preferences p where p.path = a.path || '/Contents/Info.plist' and p.key = 'SUFeedURL' and feed_url like 'http://%') feeds left outer join preferences p2 on p2.path = app_path || '/Contents/Frameworks/Sparkle.framework/Resources/Info.plist' where (p2.key = 'CFBundleShortVersionString' OR coalesce(p2.key, '') = '');",
"interval" : "86400",
"platform" : "darwin",
"version" : "1.4.5",
"description" : "Retrieves all application bundles using unauthenticated Sparkle update feeds. See https://vulnsec.com/2016/osx-apps-vulnerabilities/ for details.",
"value" : "Tracking vulnerable applications updates may allow blocking of DNS or removal by BundleID."
}
}
}