Awesome Privacy

Recent Commits

• Scott R. Shinn (09 Feb 26)

  Merge pull request #2188 from atomicturtle/crash-2026-02-08 Fix analysisd crash on sid_prev_matched list overflow (closes #1748)

• Scott R. Shinn (09 Feb 26)

  Fix analysisd crash on sid_prev_matched list overflow (closes #1748) When a rule with if_matched_sid triggers and the sid_prev_matched list reaches maximum size, OSList_AddData() automatically deletes the oldest node. However, the Eventinfo structure for that deleted node still had sid_node_to_delete pointing to the freed node. When Free_Eventinfo() was later called, it attempted to delete the already-freed node, causing a double-free crash. Fix: - Added Mark_EventNodeDelete() callback in rules_list.c that clears sid_node_to_delete before nodes are auto-deleted - Registered callback via OSList_SetFreeDataPointer() when creating sid_prev_matched lists - Added regression test issue_1748_sid_list_crash.c that reproduces the bug and verifies the fix Testing: - Valgrind confirms 0 errors after fix (was 7 errors before) - Test shows sid_node_to_delete properly cleared to NULL before auto-deletion prevents double-free This resolves production crashes reported every 24-48 hours when rules with if_matched_sid are heavily used.

• Scott R. Shinn (08 Feb 26)

  Merge pull request #2186 from atomicturtle/issue737 Fix ICMP logging in firewall.log (#737)

• Scott R. Shinn (08 Feb 26)

  Fix ICMP logging in firewall.log (#737) - Allow FW_Log to process events without src/dst ports (e.g. ICMP) - Safely handle missing ports in firewall.log output - Resolves issue where valid firewall events were dropped due to missing ports Signed-off-by: Scott R. Shinn <scott@atomicorp.com>

• Scott R. Shinn (08 Feb 26)

  Merge pull request #2185 from atomicturtle/issue524 Fix Windows version reporting

• Scott R. Shinn (08 Feb 26)

  Reviewed Signed-off-by: Scott R. Shinn <scott@atomicorp.com>

• Scott R. Shinn (08 Feb 26)

  Initialize bOsVersionInfoEx to FALSE Fixes potential undefined behavior where bOsVersionInfoEx could be read uninitialized if RtlGetVersion fails or is not present. Signed-off-by: Scott R. Shinn <scott@atomicorp.com>

• Scott R. Shinn (08 Feb 26)

  Fix Windows version reporting and DB reconnection logic - Use RtlGetVersion to correctly identify Windows 8.1+ and Server 2012 R2+ - Add support for Windows 10, 11, and Server 2016-2025 - Reset error_count in ossec-dbd after successful reconnection (Fixes #447) - Resolves #524 Signed-off-by: Scott R. Shinn <scott@atomicorp.com>

• Scott R. Shinn (08 Feb 26)

  Merge pull request #2184 from atomicturtle/issue447 Ossec-dbd connector fix

• Scott R. Shinn (08 Feb 26)

  Ossec-dbd connector fix ossec-dbd will reset its error_count upon successful reconnection, preventing it from incorrectly hitting the error limit due to accumulated transient failures. Signed-off-by: Scott R. Shinn <scott@atomicorp.com>

• Scott R. Shinn (05 Feb 26)

  Merge pull request #2183 from atomicturtle/centos7 C99 adjustments

• Scott R. Shinn (05 Feb 26)

  C99 adjustments - vetted on el7 Signed-off-by: Scott R. Shinn <scott@atomicorp.com>

• Scott R. Shinn (01 Feb 26)

  Merge pull request #2181 from atomicturtle/issue_776 Increase default decoder field limit to 256 (Issue #776)

• Scott R. Shinn (01 Feb 26)

  Merge pull request #2180 from atomicturtle/issue162 Fix Issue #162: use_own_name doesn't work in ossec-logtest

• Scott R. Shinn (01 Feb 26)

  Increase default decoder field limit to 256 (Issue #776) Increases MAX_DECODER_ORDER_SIZE from 20 to 1024 to support larger decoders. Updates default analysisd.decoder_order_size in internal_options.conf to 256. Adds regression test issue_776 verifying 30-field extraction. Signed-off-by: Scott R. Shinn <scott@atomicorp.com>

• Scott R. Shinn (01 Feb 26)

  Fix Issue #162: use_own_name doesn't work in ossec-logtest The use_own_name decoder option was not working correctly in ossec-logtest. Child decoders with use_own_name=true were incorrectly displaying the parent decoder's name instead of their own name. Root cause: The decoder name was being printed before child decoder matching completed, so it always showed the parent decoder name. Fix: Added decoder name print statements before all return points in DecodeEvent(), ensuring lf->decoder_info->name is printed after ALL decoding completes (both prematch and regex matching). This handles: - Decoders with prematch only - Decoders with regex only (no prematch) - Decoders with both prematch and regex - Plugin decoders Changes: - src/analysisd/decoders/decoder.c: Added decoder print before each return statement (lines 158, 204, 267, 295, 301) - src/tests/regressions/issue_162: Added regression test to verify postfix-reject decoder correctly shows its own name Tested on remote server with postfix-reject decoder - PASSED Fixes #162

• Scott R. Shinn (01 Feb 26)

  Merge pull request #2179 from atomicturtle/version-update Update version to 4.0.0

• Scott R. Shinn (01 Feb 26)

  Update version to 4.0.0 - Update version strings across all files - Add comprehensive CHANGELOG with breaking changes documentation - Document AES encryption as new default (not backwards compatible with 3.8.0) - Document SHA-256 FIM enabled by default - Include all 17 PRs since 3.8.0 (4 security fixes, 13 improvements) Files updated: - Version files: src/VERSION, src/headers/defs.h, ossec-hids.spec - Windows files: src/win32/help.txt, src/win32/ossec-installer.nsi - Init scripts: src/init/ossec-{client,local,server}.sh - Documentation: INSTALL, README.md, CONFIG, BUGS - CHANGELOG.md with comprehensive release notes Security fixes: - UAF bugs (Issues #1817, #1818) - XML recursion vulnerability (Issue #1953) - Secure RNG implementation for agent keys Improvements: - FIM modernization with SHA-256 support - Library updates (Lua 5.4.7, zlib 1.3.1, cJSON 1.7.18) - Bug fixes and error handling improvements

• Scott R. Shinn (26 Jan 26)

  Merge pull request #2178 from atomicturtle/260125-03 Fix Issue 1818: Heap UAF in syscheck decoder

• Scott R. Shinn (26 Jan 26)

  Fix critical UAF bug in memory leak fix (Option 2) Previous fix had a use-after-free: we freed program_name/hostname then immediately used the freed pointer in os_strdup(). New approach (Option 2): - Only duplicate if flag is NOT set (string not already owned) - If flag is set, string is already a separate allocation, skip duplication - More efficient and avoids UAF entirely Credit: Copilot code review

• Scott R. Shinn (26 Jan 26)

  Fix memory leak edge cases in UAF fixes Addresses code review findings: 1. Free existing allocation before strdup if flag already set (event reuse) 2. Zero_Eventinfo now frees flagged memory before NULLing pointers 3. Free_Eventinfo clears flags after freeing and NULLs pointers 4. Remove redundant NULL checks before free() These changes prevent memory leaks in edge cases like event reuse and ensure robust memory management throughout event lifecycle.

• Scott R. Shinn (25 Jan 26)

  Use os_strdup instead of strdup for UAF fixes - Improves error handling consistency with codebase conventions - os_strdup calls ErrorExit on OOM instead of returning NULL - Ensures allocation success before setting ownership flags - Addresses Copilot code review feedback

• Scott R. Shinn (25 Jan 26)

  Fix Issue 1818: Heap UAF in syscheck decoder - Preserve program_name and hostname before freeing full_log - Set ownership flags (EF_FREE_PNAME, EF_FREE_HNAME) for proper cleanup - Fixes CVE-2020-8447 - Includes regression test to verify fix

• Scott R. Shinn (25 Jan 26)

  Merge pull request #2177 from atomicturtle/260125-02

• Scott R. Shinn (25 Jan 26)

  Enhance Issue 1814 regression test with ANSI and UTF-8 checks

• Scott R. Shinn (25 Jan 26)

  Fix Issue 1817: Heap UAF with leak-free Eventinfo refactor

• Scott R. Shinn (25 Jan 26)

  Fix Issue 1817: Heap UAF in OSSEC Alert decoder

• Scott R. Shinn (25 Jan 26)

  Add regression test for Issue 1814 (Control characters in OS_CleanMSG)

• Scott R. Shinn (25 Jan 26)

  Merge pull request #2167 from atomicturtle/net-02 AES cryptography support

• Scott R. Shinn (24 Jan 26)

  Merge pull request #2175 from atomicturtle/fix-xml-recursion Fix uncontrolled recursion in os_xml _ReadElem (Closes issue #1953)