Hello we discovered that our fleetdm instance reported a lot osquery #fleet

Hello, we discovered that our fleetdm instance rep...

Filip

08/29/2023, 10:04 AM

Hello, we discovered that our fleetdm instance reported a lot of false positive. There is any possibilties to manualy manage cpe translation? Or to manage any other vulnerabilities checker to improve accuracy ?

Filip

08/29/2023, 11:42 AM

e.g.

Filip

08/29/2023, 11:44 AM

hosts for both are the same.... so im wondering why we got 2 different result for same.

Filip

08/29/2023, 12:00 PM

you can see also that fleetdm is not getting version of SQL Server

Kathy Satterlee

08/29/2023, 3:20 PM

Hey @Filip! What version of Fleet are you running? What other false positives are you running in to?

Filip

08/29/2023, 6:06 PM

currently we're running latest version 4.36.0. We observing much more false positives. On test host, where we have installed the newest host agent we got more false positives but i based on trust that users really updated software. At this moment im 100 % sure that there is something wrong with sql server vulnerabiility check

Copy code

SoftwareName    : Microsoft SQL Server 2012
SoftwareVersion : 
AffectedUsers   : 2
CVECount        : 101
CPE             : cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:windows:*:*

SoftwareName    : Microsoft SQL Server 2012 (64-bit)
SoftwareVersion : 
AffectedUsers   : 3
CVECount        : 101
CPE             : cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:windows:*:*

SoftwareName    : Microsoft SQL Server 2017
SoftwareVersion : 
AffectedUsers   : 1
CVECount        : 101
CPE             : cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:windows:*:*

SoftwareName    : Microsoft SQL Server 2017 (64-bit)
SoftwareVersion : 
AffectedUsers   : 5
CVECount        : 101
CPE             : cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:windows:*:*

SoftwareName    : Microsoft SQL Server 2019 (64-bit)
SoftwareVersion : 
AffectedUsers   : 70
CVECount        : 101
CPE             : cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:windows:*:*

SoftwareName    : Microsoft SQL Server 2022 (64-bit)
SoftwareVersion : 
AffectedUsers   : 14
CVECount        : 101
CPE             : cpe:2.3:a:microsoft:sql_server:*:*:*:*:*:windows:*:*

Kathy Satterlee

08/29/2023, 6:36 PM

Any other affected software, or is it all Microsoft SQL Server?

Kathy Satterlee

08/29/2023, 6:42 PM

Can you run this query on one of the affected hosts and let me know what you get back? It looks like the underlying issue is that the version isn't coming back properly. This will show us if that's an osquery issue or something in the way we're ingesting software:

Copy code

select name, version from programs where name like "Microsoft SQL Server%";

Filip

08/30/2023, 7:30 AM

response from one of the affected host

Filip

08/30/2023, 7:30 AM

image.png

Filip

08/30/2023, 9:24 AM

another false positive :

Filip

08/30/2023, 9:25 AM

represented by:

Copy code

cpe:2.3:a:nodejs:node.js:18.17.1:*:*:*:*:windows:*:*

Filip

08/30/2023, 9:25 AM

if you go to : CVE-2023-32004

Filip

08/30/2023, 9:25 AM

resolve matching cpe i wont find 18.17.1

Filip

08/30/2023, 9:26 AM

the only CPE which i found is :

Copy code

cpe:2.3:a:nodejs:node.js:18.0.0:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:18.0.1:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:18.0.2:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:18.0.3:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:18.0.4:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:18.0.5:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:18.0.6:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:18.1.0:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:18.2.0:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:18.3.0:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:18.4.0:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:18.5.0:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:18.6.0:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:18.7.0:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:18.8.0:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:18.9.0:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:18.9.1:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:18.10.0:*:*:*:-:*:*:*
cpe:2.3:a:nodejs:node.js:18.11.0:*:*:*:-:*:*:*

Filip

08/30/2023, 9:27 AM

it look like you are not checking descripted CPE match ?

Filip

08/30/2023, 9:39 AM

for teams:

Filip

08/30/2023, 9:39 AM

Copy code

cpe:2.3:a:microsoft:teams:1.6.00.22378:*:*:*:*:windows:*:*

Filip

08/30/2023, 9:39 AM

https://nvd.nist.gov/vuln/detail/CVE-2023-24881#range-9408135

Filip

08/30/2023, 9:40 AM

in the list there is no matching version

Filip

08/30/2023, 9:40 AM

there is a lot more examples for false positives

Filip

08/30/2023, 9:40 AM

i wont send all of them because it will last ages 🙂

Kathy Satterlee

08/30/2023, 3:14 PM

Thanks @Filip. Would you be willing to submit a bug report ticket for this? It definitely looks like there's something amiss. I'd be happy to submit it for you, but you've got access to the information so it seems like a good idea to cut out the middle man :)

Filip

08/30/2023, 3:16 PM

yes, i will mentioned you into this bug ok ?

Filip

08/31/2023, 8:56 AM

@Kathy Satterlee it will be great if you will paricipate in this bug 🙂 https://github.com/fleetdm/fleet/issues/13615

Kathy Satterlee

08/31/2023, 2:51 PM

Thanks @Filip! I've gotten the intake process going for that and we'll be taking a look at what the root of the issue is so we can fix it. Really appreciate the report... vulnerability processing is tricky.

Filip

10/02/2023, 11:36 AM

Hi @Kathy Satterlee, do you know any estimated date for this fix release ?

Kathy Satterlee

10/02/2023, 2:29 PM

It doesn't look like we're scheduled for a release at the moment, the team is still looking in to the root cause of the issue.

2 Views

Open in Slack

Previous Next