<?xml version="1.0" encoding="utf-8"?>
<oval-def:oval_definitions xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:oval="http://oval.mitre.org/XMLSchema/oval-common-5" xmlns:oval-def="http://oval.mitre.org/XMLSchema/oval-definitions-5" xmlns:ind-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#independent" xmlns:win-def="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://oval.mitre.org/XMLSchema/oval-common-5 oval-common-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5 oval-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#independent independent-definitions-schema.xsd http://oval.mitre.org/XMLSchema/oval-definitions-5#windows windows-definitions-schema.xsd">
  <oval-def:generator>
    <oval:schema_version>5.3</oval:schema_version>
    <oval:timestamp>2017-01-31T12:34:45</oval:timestamp>
  </oval-def:generator>
  <oval-def:definitions>
    <oval-def:definition id="oval:com.kaspersky.ics-cert:def:24" version="1" class="vulnerability">
      <oval-def:metadata>
        <oval-def:title>Malformed ASN1 streams in V2C and similar input files can be used to generate stack buffer overflows.</oval-def:title>
        <oval-def:reference source="KL-ICS-CERT" ref_id="KLCERT-17-003" ref_url="https://ics-cert.kaspersky.com/advisories/2017/07/28/klcert-17-003-sentinel-ldk-rte-malformed-asn1-streams-in-v2c-files-lead-to-remote-code-execution/" />
        <!--<reference source="CVE" ref_id="CVE-2017-11496" ref_url="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11496"/>-->
        <oval-def:description>
          Malformed ASN1 streams in V2C and similar input files can be used to generate stack buffer overflows. The vulnerability can be exploited for an arbitrary code execution.
        </oval-def:description>
      </oval-def:metadata>
      <oval-def:criteria operator="AND">
        <oval-def:criterion test_ref="oval:com.kaspersky.ics-cert:tst:71" comment="hasplms.exe version less than or equal to 19.0.1.64256 installed" />
        <oval-def:criterion test_ref="oval:com.kaspersky.ics-cert:tst:73" comment="Sentinel License Manager rule exists and enabled" />
      </oval-def:criteria>
    </oval-def:definition>
  </oval-def:definitions>
  <oval-def:tests>
    <win-def:file_test id="oval:com.kaspersky.ics-cert:tst:71" check="at least one" version="1" comment="hasplms.exe has version less than or equal to 19.0.1.64256">
      <win-def:object object_ref="oval:com.kaspersky.ics-cert:obj:65" />
      <win-def:state state_ref="oval:com.kaspersky.ics-cert:ste:58" />
    </win-def:file_test>
    <win-def:registry_test id="oval:com.kaspersky.ics-cert:tst:73" check="at least one" version="1" comment="Sentinel License Manager rule exists and enabled">
      <win-def:object object_ref="oval:com.kaspersky.ics-cert:obj:66" />
      <win-def:state state_ref="oval:com.kaspersky.ics-cert:ste:60" />
    </win-def:registry_test>
  </oval-def:tests>
  <oval-def:objects>
    <registry_object xmlns="http://oval.mitre.org/XMLSchema/oval-definitions-5#windows" comment="This registry key identifies the system root." id="oval:org.mitre.oval:obj:219" version="3">
      <hive>HKEY_LOCAL_MACHINE</hive>
      <key>SOFTWARE\Microsoft\Windows NT\CurrentVersion</key>
      <name>SystemRoot</name>
    </registry_object>
    <win-def:file_object id="oval:com.kaspersky.ics-cert:obj:65" version="1">
      <win-def:path var_check="all" var_ref="oval:org.mitre.oval:var:200" />
      <win-def:filename>hasplms.exe</win-def:filename>
    </win-def:file_object>
    <win-def:registry_object id="oval:com.kaspersky.ics-cert:obj:66" comment="Windows firewall rules" version="1">
      <win-def:hive>HKEY_LOCAL_MACHINE</win-def:hive>
      <win-def:key>SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules</win-def:key>
      <win-def:name operation="pattern match">.*</win-def:name>
    </win-def:registry_object>
  </oval-def:objects>
  <oval-def:states>
    <win-def:file_state id="oval:com.kaspersky.ics-cert:ste:58" comment="State matches if version is less than or equal to 19.0.1.64256" version="1">
      <win-def:version datatype="version" operation="less than or equal">19.0.1.64256</win-def:version>
    </win-def:file_state>
    <win-def:registry_state id="oval:com.kaspersky.ics-cert:ste:60" comment="Sentinel License Manager rule exists and enabled" version="1">
      <win-def:value datatype="string" operation="pattern match">\|Action=Allow\|Active=TRUE\|Dir=In\|App=[\w\\:]+\\[hH][aA][sS][pP][lL][mM][sS]\.[eE][xX][eE]</win-def:value>
    </win-def:registry_state>
  </oval-def:states>
  <oval-def:variables>
    <oval-def:local_variable comment="Windows System32 directory" datatype="string" id="oval:org.mitre.oval:var:200" version="20">
      <oval-def:concat>
        <oval-def:object_component item_field="value" object_ref="oval:org.mitre.oval:obj:219" />
        <oval-def:literal_component>\System32</oval-def:literal_component>
      </oval-def:concat>
    </oval-def:local_variable>
  </oval-def:variables>
</oval-def:oval_definitions>