OSSEC

Recent Commits

• Scott R. Shinn(24 Oct 26)

  Merge pull request #2380 from atomicturtle/fix/ant-2026-d7zvxnzp-prefilter-remote-cmd fix syscheck: refuse remote prefilter_cmd unless opted in

• Scott R. Shinn(23 Oct 26)

  fix syscheck: refuse remote prefilter_cmd unless opted in Addresses ANT-2026-D7ZVXNZP A manager-pushed agent.conf could set <syscheck><prefilter_cmd>, which syscheckd runs via popen() as root for every hashed file, even when logcollector.remote_commands=0 (the gate that already blocks <localfile><command>). Mark the shared-config parse with agent_cfg, load accept_remote from the existing logcollector.remote_commands switch, and skip prefilter_cmd from agent.conf unless that opt-in is set. Local ossec.conf prefilter_cmd is unchanged. Signed-off-by: Scott R. Shinn <[email protected]>

• Scott R. Shinn(23 Oct 26)

  Merge pull request #2379 from atomicturtle/fix/ant-2026-8tb11kjo-ossecalert-field-injection fix logcollector: sanitize ossecalert forwarded fields

• Scott R. Shinn(23 Oct 26)

  fix logcollector: sanitize ossecalert forwarded fields Addresses ANT-2026-8TB11KJO read_ossecalert() rebuilds alerts as ';'-delimited fields for the hybrid agent half. A ';' in user or srcip (for example a PIX-captured name "admin; srcip: 10.9.9.9") starts a new field on the central manager and can overwrite Src IP used for alerts and active response. Replace ';' with ',' in comment/location/srcip/user before formatting, and bound tagged srcip/user values so the closing ';' always fits the 255-byte buffers. Signed-off-by: Scott R. Shinn <[email protected]> Signed-off-by: Scott R. Shinn <[email protected]>

• Scott R. Shinn(23 Oct 26)

  Merge pull request #2378 from atomicturtle/fix/ant-2026-1uf4d24f-read-dir-path-overflow fix syscheck: bound read_dir path joins near PATH_MAX

• Scott R. Shinn(23 Oct 26)

  Copyright fix Signed-off-by: Scott R. Shinn <[email protected]>

• Scott R. Shinn(23 Oct 26)

  fix syscheck: bound read_dir path joins near PATH_MAX Addresses ANT-2026-1UF4D24F read_dir composed dir + entry with strncpy(..., PATH_MAX - dir_size - 2). When dir_size is PATH_MAX-1 the unsigned size wraps and the copy overruns f_name, crashing ossec-syscheckd. Skip entries that do not fit, join with snprintf into the remaining buffer (OS_SyscheckJoinEntryPath), warn once per directory, and mark incomplete walks for delete reconciliation. Signed-off-by: Scott R. Shinn <[email protected]>

• Scott R. Shinn(23 Oct 26)

  Merge pull request #2377 from atomicturtle/fix/ant-2026-1eazn37n-bind-unix-chmod-race fix os_net: set Unix queue socket mode at bind, not via path chmod

• Scott R. Shinn(23 Oct 26)

  fix os_net: set Unix queue socket mode at bind, not via path chmod Addresses ANT-2026-1EAZN37N chmod(path) after bind() follows symlinks; queue/alerts is group-writable and execd binds as root, so a raced link could make root-owned files group-writable. Create the socket with its final mode by setting umask(~mode & 0777) around bind() (same pattern as monitord), and drop the path chmod. Signed-off-by: Scott R. Shinn <[email protected]>

• Scott R. Shinn(23 Oct 26)

  Merge pull request #2376 from atomicturtle/fix/ant-2026-vutsb5rb-syscheck-prefix-sum fix analysisd: store syscheck index checksums on the heap

• Scott R. Shinn(23 Oct 26)

  fix analysisd: store syscheck index checksums on the heap sk_db_entry embedded prefix_sum[OS_MAXSTR+1] (~6KB) per monitored path, so one agent could pin manager RSS at ~6.2KB per new-file message (#2373). Hold the "+++sum" prefix in a strdup'd string via DB_SetEntrySum and skip index hits until the sum is set (fall back to the existing linear scan). Addresses ANT-2026-VUTSB5RB Signed-off-by: Scott R. Shinn <[email protected]>

• Scott R. Shinn(23 Oct 26)

  Merge pull request #2375 from atomicturtle/fix/ant-2026-1ixhwdkw-win-parent-folder fix Windows parent-folder check for mixed-separator AR paths (ANT-202…

• Scott R. Shinn(23 Oct 26)

  fix Windows parent-folder check for mixed-separator AR paths (ANT-2026-1IXHWDKW). Walk every '/' and '\\' with strpbrk so a trailing "/..name" cannot hide a prior "\..\" segment (CVE-2018-19666). Expose w_ref_parent_folder_ex for host-side regressions; reject '/', '\\', and ".." in Merge/Unmerge entry names so a crafted merged.mg cannot plant "..evil.cmd" for the same bypass. Signed-off-by: Scott R. Shinn <[email protected]>

• Scott R. Shinn(23 Oct 26)

  Merge pull request #2374 from atomicturtle/fix/2373-analysisd-cgroup-nproc Honor cgroup CPU limits when autoscaling analysisd threads (#2373)

• Scott R. Shinn(23 Oct 26)

  Honor cgroup CPU limits when autoscaling analysisd threads (#2373) Replace sysconf(_SC_NPROCESSORS_ONLN) with os_get_nproc(), which takes min(scheduler affinity, cgroup v1/v2 CPU quota). Cache the value before Privsep_Chroot so /proc and /sys remain readable, resolve distinct v1/v2 paths from /proc/self/cgroup, and keep the tightest ancestor quota so Docker --cpus / Kubernetes limits do not inflate analysisd thread pools and RSS. Add shared nproc_test fixtures (and expect N for e2e). Signed-off-by: Scott R. Shinn <[email protected]>

• Scott R. Shinn(22 Oct 26)

  Merge pull request #2372 from atomicturtle/fix/ant-2026-r4ss008f-ads-stream-overflow fix rootcheck: bound NTFS ADS stream name reads on Windows

• Scott R. Shinn(22 Oct 26)

  fix rootcheck: bound NTFS ADS stream name reads on Windows os_check_ads() passed WIN32_STREAM_ID.dwStreamNameSize (UTF-16 bytes from the file, up to 524 for a 255-character name) to BackupRead() into a MAX_PATH+1 stack buffer. Names longer than 123 characters overflowed the LocalSystem agent's stack on each rootcheck scan; C:\Windows\Temp allows unprivileged users to create such streams by default. Size the buffer like WIN32_FIND_STREAM_DATA.cStreamName and refuse names that do not fit before the read. Apply the same change in ads_dump. Add issue_ads_stream_overflow. Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-R4SS008F. Signed-off-by: Scott R. Shinn <[email protected]>

• Scott R. Shinn(22 Oct 26)

  Merge pull request #2371 from atomicturtle/fix/ant-2026-pmmts4qr-ar-location-injection fix analysisd: stop AR location text from injecting remoted flags

• Scott R. Shinn(22 Oct 26)

  fix analysisd: stop AR location text from injecting remoted flags ossec-remoted splits active-response requests on spaces and reads the routing flags immediately after the source field. OS_Exec() put the full lf->location there first, so spaces after "->" (from an agent message or an ossec-alert Location: field) were parsed as ALL/REMOTE/SPECIFIC flags, agent id, and command. A local logger line on one host could therefore run host-deny/firewall-drop on every agent, including with allow-listed addresses and values that skip analysisd's srcip checks. Format only the manager-written "(name) ip" prefix (cut at "->"), or a constant "[]" for local events, ahead of the flags. Reject agent locations that lack "->". Add issue_ar_location_injection. Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-PMMTS4QR. Signed-off-by: Scott R. Shinn <[email protected]>

• Scott R. Shinn(21 Oct 26)

  Merge pull request #2370 from atomicturtle/fix/ant-2026-tdah6u83-logs-symlink-nofollow fix execd/logging: refuse symlinks when root appends under logs/

• Scott R. Shinn(20 Oct 26)

  fix tests: link log_append where debug_op is compiled in thread_pool_test and the maild unit tests pull debug_op.c/.o, which now calls open_log_append(); without log_append they fail the Rocky CI link.

• Scott R. Shinn(20 Oct 26)

  fix shared: put open_log_append in its own translation unit _log() now calls open_log_append(), which pulled file_op.o (and its __local_name definition) into regression binaries that define their own __local_name, breaking the Rocky server CI link of getalert_empty_filename.

• Scott R. Shinn(20 Oct 26)

  fix execd/logging: refuse symlinks when root appends under logs/ logs/ is owned by the unprivileged ossec user while root ossec-execd and other daemons append there by name. Replacing active-responses.log or ossec.log with a symlink let that account choose any path root writes, and newlines in execq arguments became whole lines in the target (ossec to root, same class as CVE-2014-5284). Add open_log_append() (O_NOFOLLOW, regular file, nlink==1). Have ExecCmd open AR_LOGPATH that way and dup2 it onto the script's stdout/stderr; drop ">> logs/active-responses.log" from the Unix AR scripts. Route _log() through the same helper for ossec.log. Strip control characters from execq requests. Add issue_logs_symlink_nofollow regression. Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-TDAH6U83. Signed-off-by: Scott R. Shinn <[email protected]>

• Scott R. Shinn(20 Oct 26)

  Merge pull request #2369 from atomicturtle/fix/ant-2026-8r0yef8t-cleanevent-date-oob fix analysisd: bound umlaut and Suricata date probes in OS_CleanMSG_ex

• Scott R. Shinn(20 Oct 26)

  Merge branch 'main' into fix/ant-2026-8r0yef8t-cleanevent-date-oob Keep clean targets for both the new date-oob objects and the ossecalert hostname objects from #2368.

• Scott R. Shinn(20 Oct 26)

  fix analysisd: bound umlaut and Suricata date probes in OS_CleanMSG_ex OS_CleanMSG_ex() date probes are gated by loglen except the Mär umlaut repair, which read pieces[1]/pieces[2] with no length check. An empty log text (empty monitored line or agent message ending at the location) made those reads one byte past the pipeline's exact-size message buffer. The Suricata branch checked loglen > 26 but advanced lf->log by 28, so a 27-character date-only line left lf->log on the unused last byte of the dual full_log allocation. Decoders and rules then used stale heap bytes; on the syscheck queue DecodeSyscheck could write into the next chunk and abort analysisd. Require loglen > 3 before the umlaut repair and loglen > 28 for Suricata (matching neighbouring probes). Add issue_cleanevent_date_oob regression. Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-8R0YEF8T. Signed-off-by: Scott R. Shinn <[email protected]>

• Scott R. Shinn(20 Oct 26)

  Merge pull request #2368 from atomicturtle/fix/ant-2026-5zoe8cq9-ossecalert-hostname-double-free fix analysisd: release owned hostname before ossecalert location alias

• Scott R. Shinn(20 Oct 26)

  fix analysisd: release owned hostname before ossecalert location alias Since #1668, OS_CleanMSG_ex() can hand OSSECAlert_Decoder_Exec() an agent event whose hostname is a heap copy of the agent name with EF_FREE_HNAME set. The decoder then set lf->hostname = lf->location without clearing that ownership flag, so Free_Eventinfo() freed the same buffer twice and aborted analysisd. Free the owned hostname and clear EF_FREE_HNAME immediately before the alias. The existing #1817 path then duplicates hostname on a full decode; early returns keep the unowned alias as before #1668. Add issue_1668_ossecalert_hostname regression. Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-5ZOE8CQ9. Signed-off-by: Scott R. Shinn <[email protected]>

• Scott R. Shinn(20 Oct 26)

  Merge pull request #2367 from atomicturtle/fix/ant-2026-rykb1oli-win-execd-cmd-injection fix Windows execd: neutralize cmd.exe metacharacters in AR args

• Scott R. Shinn(20 Oct 26)

  fix Windows execd: neutralize cmd.exe metacharacters in AR args WinExecdRun builds a quoted CreateProcess command line for .cmd active responses. An enrolled agent can put a double quote in the event location; cmd.exe then treats following "&…&" as a separate command and runs it as LocalSystem on other Windows agents with AR enabled. Sanitize user, IP, and the request remainder (including location) with OS_WinExecdCleanArg before both the add and timeout-delete lines are built: replace '"', '%', and control characters with '_'. Add issue_win_execd_cmd_injection regression. Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-RYKB1OLI. Signed-off-by: Scott R. Shinn <[email protected]>