[Prelude Hybrid IDS] #142: DTD violations with XML logging and Nepenthes log-prelude module

#142: DTD violations with XML logging and Nepenthes log-prelude module
-----------------------------------------+----------------------------------
 Reporter:  [email protected]  |       Owner:  yoann
     Type:  defect                       |      Status:  new  
 Priority:  normal                       |   Milestone:       
Component:  prelude-manager              |     Version:  0.9  
 Severity:  normal                       |    Keywords:       
-----------------------------------------+----------------------------------
 I am using Nepenthes svn-r385 with the log-prelude module. On the server-
 side there is a prelude-manager 0.9.1 with mysql and xml logging enabled.
 The DTD validation for xml is enabled.


 Messages concerning Malware submissions, make DTD violations. I think this
 is not the fault of prelude-manager, its in the nepenthes module.

 {{{
 <IDMEF-Message>
   <Alert messageid="87043074066">
     <Analyzer analyzerid="X" name="prelude-manager"
 manufacturer="http://www.prelude-ids.com" model="Prelude Manager"
 version="0.9.1" class="Concentrator" ostype="Linux" osversion="X">
       <Process>
         <name>prelude-manager</name>
         <pid>4105</pid>
         <path>/usr/bin/prelude-manager</path>
       </Process>
       <Analyzer analyzerid="X" name="nepenthes"
 manufacturer="http://nepenthes.sf.net" version="$Rev: 358 $"
 ostype="Linux" osversion="2.6.12.6-xen">
         <Node category="unknown"><location>X</location>
           <name>Wrmcatcher</name>
         </Node>
         <Process>
           <name></name>
           <pid>3070</pid>
         </Process>
       </Analyzer>
     </Analyzer>
     <CreateTime
 ntpstamp="0xc7d66931.0x58e43000">2006-03-30T16:26:57.347232+02:00</CreateTime>
     <AnalyzerTime
 ntpstamp="0xc7d66931.0x58ef7000">2006-03-30T16:26:57.347404+02:00</AnalyzerTime>
     <Source spoofed="unknown">
       <Node category="unknown">
         <Address category="unknown">
           <address>X.X.X.X</address>
         </Address>
       </Node>
       <Service>
         <port>69</port>
         <protocol>UDP</protocol>
         <WebService>
           <url>tftp://X/hostserv.exe</url>
           <http-method>get</http-method>
         </WebService>
       </Service>
     </Source>
     <Target decoy="unknown">
       <Node category="unknown">
         <Address category="unknown">
           <address>10.X.X.X</address>
         </Address>
       </Node>
       <File category="">
         <name>hostserv.exe</name>
         <path></path>
         <data-size>205312</data-size>
       </File>
     </Target>
     <Classification text="Malware submited">
       <Reference origin="vendor-specific">
         <name></name>
 <url>http://nepenthes.sf.net/wiki/submission/41805c3fe378b19ebc93aa0f0339dfa0</url>
       </Reference>
     </Classification>
     <Assessment>
       <Impact severity="high" type="other">possible Malware stored for
 further analysis</Impact>
     </Assessment>
   </Alert>
 </IDMEF-Message>
 element File: validity error : Syntax of value for attribute category of
 File is not valid
 element File: validity error : Value "(null)" for attribute category of
 File is not among the enumerated set
 }}}

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/142>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite

_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel