Please see the Community Solution Testing Statement
+This Task performs a filesystem scan on Linux systems to attempt detecting Apache Commons Text versions vulnerable to CVE-2022-42889.
++
This Task performs a filesystem search across all fixed disks on Linux platforms, to locate Apache Commons Text JAR files, either directly on the filesystem or embedded in a .WAR archive file. In the case any .WAR file is found on the system, the 'unzip' utility is used to perform a listing of files inside the archive to locate Apache Commons Text-related JAR files. Specifically, this Task searches for any versions of commons-text-X.X.X.jar.
+Scan results are stored in a "Scans" subdirectory beneath the "BES Client" folder. 'apache-commons-text.log' contains the full script output for potential debugging or diagnosis, and 'apache-commons-text.txt' contains a listing of detected files in one of the forms
+The first sample entry indicates a detected .jar file directly in the filesystem, while the second entry indicates a detected .jar file embedded within a .WAR archive.
+This Task has several known limitations:
+ +This detection method uses Linux Bash script with external dependencies on 'df', 'find', 'sed', and 'unzip'. Results of the scan may be retrieved using the related Analysis.
]]>++ +
+]]>
This task will remove the SUID-bit from pkexec file.
It is a generic command that can be deployed on all Linux-based endpoints
chmod 0755 /usr/bin/pkexec
You should favor patching the OS with the security update released by the vendor for any supported system, and only when this is not a viable solution, to use the mitigation approach.
Removing the SUID-bit form the pkexec file may have a negative impact on any applications.
Use this task to perform mitigation with care and test thoroughly in your environment.
This task restore the default permission on the pkexec file, that is. -rwsr-xr-x
It is a generic command that can be deployed on all Linux-based endpoints
chmod u+s /usr/bin/pkexec
This task can be used in case the PwnKit mitigation task damaged an application running on the target endpoint. It will restore the default permissions on the pkexec file that were modified by the mitigation task.
Use this task with care and test thoroughly in your environment
NOTE: The task restores the default (-rwsr-xr-x) to the pkexec file.
Official support for version 9.0 of Tiny Core Linux is coming soon to BigFix. For now, 9.0 seems to work even in 9.5.9 BigFix environments. This fixlet can aid in your testing of it.
This Fixlet can upgrade the operating system of all the instances of the Tiny Core Virtual Relays on the targeted computers to Version 9.0. It has been tested on Tiny Core Linux 7.X and 8.X.
WARNING: This fixlet is not meant to be run as-is. There is no way to predict when the Tiny Core Linux team will change the "*.tcz" files used by this fixlet, so actions started with this fixlet will likley encounter download problems in the future. The recommended way to handle this is to create a custom copy of this action where the prefectch lines in the action script are edited for the current files served by Tiny Core, then manually pre-cache those files on the bigfix server.
+How do I manually cache a file on the BigFix Server?
https://www-01.ibm.com/support/docview.wss?uid=swg21506037
make-prefetch, a Python tool to generate prefetch statements for downloads in BigFix Action Script:
https://github.com/bigfix/make-prefetch
Note: If VMware Tools are already installed on the target computer, they will be upgraded automatically.
This fixlet will upgrade relays running TinyCore 12.0 to TinyCore 14.0. The OS, kernel, and extensions will be upgraded.
This fixlet used files manually cached on the root server. You can do the upgrade without caching the files useing the tce-update and associated 'tce-' commands, however that will require a rework of the action and shell script. The cached files in this fixlet are up-to-date as of 10/23/2023.
If version rollback is needed, all files are backed up to "/home/tc/v12_backup/".
Upgrade Log: /var/log/v14_upgrade.log
The following extensions will be updated:
Exit Codes:
Log Size Threshold: 200KB
Logs Rotated (configured in external file):
Note: LogRotate.tcz will be available in TCL v13.
]]>If the FillDB file count or folder size reaches 70 percent or greater of its maximum value, an alert will be emailed.
All events will be logged: /var/log/filldb_alerts.log
]]>By default Cron logs all messages to /var/log/messages. This fixlet will change the cron message location to a separate file.
Implementation:
- This is only relevant on VRAs that already have crond set to start on boot.
- Creates a new file: /var/log/cron.log
- Edits the crond init script to set the new log location
- Adds the crond init script to the filetool
- Runs a filetool backup
Removes all files older than 72 hours in "var/opt/BESRelay/UploadManagerData/BufferDir/Temp".
Removes all files older than 72 hours in "/var/opt/BESRelay/UploadManagerData/BufferDir/sha1/" and restarts the relay service if files are present.
]]>