8.2. Vulnerability Scanning
8.2.1. Red Hat Security Advisories OVAL Feed
Red Hat Enterprise Linux security auditing capabilities are based on the Security Content Automation Protocol (SCAP) standard. SCAP is a multi-purpose framework of specifications that supports automated configuration, vulnerability and patch checking, technical control compliance activities, and security measurement.
SCAP specifications create an ecosystem where the format of security content is well-known and standardized although the implementation of the scanner or policy editor is not mandated. This enables organizations to build their security policy (SCAP content) once, no matter how many security vendors they employ.
The Open Vulnerability Assessment Language (OVAL) is the essential and oldest component of SCAP. Unlike other tools and custom scripts, OVAL describes a required state of resources in a declarative manner. OVAL code is never executed directly but using an OVAL interpreter tool called scanner. The declarative nature of OVAL ensures that the state of the assessed system is not accidentally modified.
Like all other SCAP components, OVAL is based on XML. The SCAP standard defines several document formats. Each of them includes a different kind of information and serves a different purpose.
Red Hat Product Security helps customers evaluate and manage risk by tracking and investigating all security issues affecting Red Hat customers. It provides timely and concise patches and security advisories on the Red Hat Customer Portal. Red Hat creates and supports OVAL patch definitions, providing machine-readable versions of our security advisories.
Because of differences between platforms, versions, and other factors, Red Hat Product Security qualitative severity ratings of vulnerabilities do not directly align with the Common Vulnerability Scoring System (CVSS) baseline ratings provided by third parties. Therefore, we recommend that you use the RHSA OVAL definitions instead of those provided by third parties.
The RHSA OVAL definitions are available individually and as a complete package, and are updated within an hour of a new security advisory becoming available on the Red Hat Customer Portal.
Each OVAL patch definition maps one-to-one to a Red Hat Security Advisory (RHSA). Because an RHSA can contain fixes for multiple vulnerabilities, each vulnerability is listed separately by its Common Vulnerabilities and Exposures (CVE) name and has a link to its entry in our public bug database.
The RHSA OVAL definitions are designed to check for vulnerable versions of RPM packages installed on a system. It is possible to extend these definitions to include further checks, for example, to find out if the packages are being used in a vulnerable configuration. These definitions are designed to cover software and updates shipped by Red Hat. Additional definitions are required to detect the patch status of third-party software.
Note
To scan containers or container images for security vulnerabilities, see Section 8.9, “Scanning Containers and Container Images for Vulnerabilities”.
8.2.2. Scanning the System for Vulnerabilities
The oscap command-line utility enables you to scan local systems, validate configuration compliance content, and generate reports and guides based on these scans and evaluations. This utility serves as a front end to the OpenSCAP library and groups its functionalities to modules (sub-commands) based on the type of SCAP content it processes.
Procedure
- Install the openscap-scanner and the bzip2 packages:
~]#yum install openscap-scanner bzip2 - Download the latest RHSA OVAL definitions for your system, for example:
~]#wget -O - https://www.redhat.com/security/data/oval/v2/RHEL7/rhel-7.oval.xml.bz2 | bzip2 --decompress > rhel-7.oval.xml - Scan the system for vulnerabilities and save results to the vulnerability.html file:
~]#oscap oval eval --report vulnerability.html rhel-7.oval.xml
Verification
- Check the results in a browser of your choice, for example:
~]$firefox vulnerability.html &
Note
A CVE OVAL check searches for vulnerabilities. Therefore, the result “True” means the system is vulnerable, whereas “False” means the scan found no vulnerabilities. In the HTML report, this is further distinguished by the color of the result row.
Additional Resources
- The
oscap(8)man page. - The Red Hat OVAL definitions list.
8.2.3. Scanning Remote Systems for Vulnerabilities
You can check also remote systems for vulnerabilities with the OpenSCAP scanner using the
oscap-ssh tool over the SSH protocol.
Prerequisites
- The openscap-scanner package is installed on the remote systems.
- The SSH server is running on the remote systems.
Procedure
- Install the openscap-utils and bzip2 packages:
~]#yum install openscap-utils bzip2 - Download the latest RHSA OVAL definitions for your system:
~]#wget -O - https://www.redhat.com/security/data/oval/v2/RHEL7/rhel-7.oval.xml.bz2 | bzip2 --decompress > rhel-7.oval.xml - Scan a remote system with the machine1 host name, SSH running on port 22, and the joesec user name for vulnerabilities and save results to the remote-vulnerability.html file:
~]#oscap-ssh joesec@machine1 22 oval eval --report remote-vulnerability.html rhel-7.oval.xml
Additional Resources
- The
oscap-ssh(8)man page. - The Red Hat OVAL definitions list.
