Mitre.org defines OVAL as following:
Open Vulnerability and Assessment Language (OVAL) is an international, information security, community standard to promote open and publicly available security content, and to standardize the transfer of this information across the entire spectrum of security tools and services. OVAL includes a language used to encode system details, and an assortment of content repositories held throughout the community. The language standardizes the three main steps of the assessment process :
. Representing configuration information of systems for testing;
. Analyzing the system for the presence of the specified machine state (vulnerability, configuration, patch state, etc.);
. Reporting the results of this assessment.
Platforms: Windows 2000, Windows 3.x, Windows 95/98, Windows CE, Windows NT, Windows XP
Categories: Auditing, Host
Version: 1.5
URL: http://www.security-database.com/ssa.php
A local vulnerabilty analyzer based on OVAL concept.
http://www.security-database.com/ssa.php
1.5 Final Release
* NOW SSA Security System Analyzer in added to OVAL.mitre.org compatibility program
o http://oval.mitre.org/compatible/questionnaires/21.html
* NOW fully based on OVAL 5.2 Interpreter.
* Added OVAL XML Database Plug-in.
o View OVAL ID Information
o Search by OS and OVAL ID
+ Double click on entry and get more information (linked to OVAL.mitre.org and security-database.com)
o More information about CVE (CVSS, Related sources, Related missed patches....)
* Added function Stop/Reload in SSA
* Improved performance in SSA Core Scanner
* Fixed bugs (function checks, abnormal scan abort...)
* Fixed bugs in Updater Plug-in
* Added second progress bar in Updater Plug-in to indicate the stages left to be processed.
For any information about OVAL, you should refer to http://oval.mitre.org.
For any information about Making Security Measurable, please refer to http://measurablesecurity.mitre.org/
Suggestions, bug reporting to the author
This e-mail address is being protected from spam bots, you need JavaScript enabled to view it
download : http://www.security-database.com/software/SSAInstall_1.6b2-fix.exe
documentation : http://www.security-database.com/software/ssa-manual-v1.2.pdf
screen shoot :
. http://www.security-database.com/layout_images/SSA/ssa-2.gif
. http://www.security-database.com/layout_images/SSA/ssa-1.gif
SSA (Security System Analyzer) is free non-intrusive OVAL-Compatible software. It provides security testers, auditors with an advanced overview of the security policy level applied.
