Open Vulnerability and Assessment Language

In version 5.7 the record datatype was introduced. In creating this new datatype the schema definition of the base entity types was refactored to allow for complex content within an entity. The goal was to allow for either a defined set of child element or simple content with in an entity. In version 5.7 this was achieved by creating one base entity type and then extending or restricting it as needed to create all other entity types. This approach introduced an invalid restriction of a complex type with complex content by a complex type with simple content.

The solution to this issue in the version 5.9 draft 1 is to create two distinct base entity types. One will be extended by all entities with simple content and the other will be extended by all entity types with complex content. This approach addresses the schema defect, helps better organize the definitions of the attributes on an entity, and should lend itself well to further development of the language.

For more information please refer to the developer list archive on this topic:
http://making-security-measurable.1364806.n2.nabble.com/Output-validation-errors-illegal-derivation-of-anyType-tp5608821p5608821.html

n/a

As of version 5.8, the Scheamtron rules used to enforce the oval-results directives use the exists() function. The exists() function is an xpath 2.0 function. OVAL uses xpath 1.0. The function can simply be removed since it is used to do a boolean test on a node set. The node set can be treated as a boolean without this function.

n/a

The win-sc:activedirectory_item, win-sc:activedirectory57_item, ind-sc:ldap_item, and ind-sc:ldap57_item contain old documentation that should have been updated in Version 5.6 along with their respective objects as described in the following oval-developer-list post.

http://n2.nabble.com/Proposal-to-Modify-the-win-def%3Aactivedirectory_test-and-the-ind-def%3Aldap_test-tp3351022ef20093.html

n/a

The current macos-def:accountinfo_test documentation mentions that niutil(1) can be used to retrieve the information for the test. However, as of Mac OS 10.5, niutil(1) is no longer available and dscl(1) should be used instead. We should update the documentation appropriately.

Directory Service Release Notes (Mac OSX Server 10.5)
http://developer.apple.com/library/mac/#releasenotes/MacOSXServer/RN-DirectoryServices/

niutil(1) Man Page
http://developer.apple.com/library/mac/#DOCUMENTATION/Darwin/Reference/ManPages/10.4-intel/man1/niutil.1.html

dscl(1) Man Page
http://developer.apple.com/library/mac/#documentation/Darwin/Reference/ManPages/man1/dscl.1.html

The following can be used to retrieve the required information using dscl(1).

List all users
	dscl . -list /Users
	
Read attribute about a user
	dscl . -read /Users/<username> passwd uid gid realname home shell 

n/a

The documentation associated with the sol-def:patch54_object/sol-def:supersedence behavior should be updated to include a definition of what it means for one patch to supersede another.

According to Solaris documentation, a patch can be superseded in two ways:

1) Implicitly - This type of supersedence occurs when a new revision of a patch is released (i.e. patch 12345-02 supersedes patch 12345-01).

2) Explicitly - This type of supersedence occurs when one patch contains the complete functionality of another patch.

Please see Section 'Patch Accumulation and Obsolescence (SUNW_OBSOLETES)' of http://www.sun.com/blueprints/0205/819-1002.pdf for more information.

n/a

Please see the following oval-developer-list post for more information.

http://making-security-measurable.1364806.n2.nabble.com/macos-def-pwpolicy-object-Breaks-Backwards-Compatibility-in-5-7-and-5-8-tp5915193p5915193.html

n/a