Release Notes for Open-AudIT v4.3.0

Owned by Mark Unwin
Last updated: Dec 02, 2021
2 min read

Released 2021-12-01

Linux SHA256 - 4c27c60e1f6ea96bbdf5a7f21fbc9d80ca2e2991091215d481fc1c6c60e3fc9a

Linux MD5 - 454316502bf423faa2336f8f5ad7f133

This release of Open-AudIT was bought forward because of the disclosure of two vulnerabilities.

This release fixes these issues.

The details of each can be found at:


VersionTypeCollectionDescription
ProfessionalBugIntegrationsWhen multiple integrations are configured, multiple identical attributes would appear in the integrations details on the device details page.
ProfessionalNew FeatureDiscoveriesRetrieve and display installed certificates on Linux. Both system wide and Apache specific.
ProfessionalNew FeatureDiscoveriesRetrieve and display USB connected devices (exclude bluetooth on Windows).
ProfessionalImprovementQueriesAdd Query Details button to Query Execute template.
CommunityImprovementDiscoveries

There was an issue with PHP's SNMPv3 implementation. This is resolved for Linux where we now use net-snmp for initial credential testing. For Windows we cannot do this so the caveat is that where SNMPv3 is used, you must not have multiple credential sets (for SNMPv3) with identical security names.

ProfessionalImprovementLicensesAdd a license expiry date to /licenses entries.
ProfessionalImprovementDiscoveriesProvide a list of discovery issues with hints to how to resolve them.
ProfessionalBugDiscoveriesFix Active Directory discovery type option. AD discoveries now work again.
ProfessionalBugIntegrationsFix integrations fields for bool_one_zero and bool_y_n always staying 'false'.
ProfessionalImprovementDevicesProvide an indication on the Devices List screen to indicate level of audit performed.
CommunityBugUtilFilter out all characters except those in the allowed list for determining number of IPs in range or subnet for util::subnet_size. See Errata - 4.2.0, 3.5.0 and onwards util function vulnerability
CommunityBugAllFix link creation to exclude user input. See Errata - 4.2.0 and earlier Javascript vulnerability
CommunityImprovementAllFor spawning processes, no longer use the execute script with a URL, now call PHP directly. No longer a requirement for http to be available from localhost.
CommunityImprovementUtilAllow downloading test_windows_client.vbs using the web interface at util/test_windows_client.
CommunityImprovementAudit

Improvements to test_windows_client.vbs:

  • checks for RPC and NetLogon services
  • OS architecture
CommunityImprovementDiscoveriesFix audit_linux.sh to allow running on BusyBox.
EnterpriseImprovementCloudsDelete the associated discovery when we delete the cloud.
CommunityImprovementDiscoveriesUpdate the MAC -> Manufacturer helper with more manufacturers.
CommunityImprovementDiscoveries

Add Fortinet Fortigate models to SNMP Model Helper.

CommunityImprovementDiscoveriesDetect Quest InTrust Agent in audit_linux.sh.
CommunityBugDevicesFix for image upload path traversal issue.
CommunityImprovementDevicesAutomatically add to filter for oae_manage if request from Open-AudIT Enterprise on devices collection.
CommunityBugDevicesFix running multiple device discoveries from the Bulk Edit screen.
CommunityImprovementDiscoveriesMake all command line calls from Linux (winexe, smbclient) use a credentials file, rather than put the credentials on the command line. All work in wmi_helper.
CommunityImprovementAllUpdate JS libraries for: jQuery Tablesorter, Bootstrap Table, Bootstrap FileStyle, Chartist.
CommunityImprovementDiscoveriesMore robust scp transfer test for success in ssh_helper.
CommunityImprovementRulesImprove discovery logging in m_rules::execute.
EnterpriseImprovementCollectorsWhen creating a discovery on a collector, include blank command_options and remove options so we're SQL Strict compliant.
ProfessionalImprovementDiscoveriesEnsure the discovery export function retrieves all discovery logs.
ProfessionalBugDevicesFix broken edit fields for Opmantek Details on devices read template for custom fields.
ProfessionalImprovementAllUpgrade JS libraries for dataTables and HighCharts.
ProfessionalImprovementDevicesOn device details, only show discovery issues for the latest discovery.