6 month EOL notice for Security Onion Xplico package

Our Xplico package will reach EOL (End Of Life) on June 5, 2018. After that date, we will no longer provide updates or support of any kind for Xplico.

Since 2015, our Setup wizard has disabled Xplico by default when choosing the "Best Practices" option:
https://github.com/Security-Onion-Solutions/securityonion-setup/blob/dd9c8e098af3e6bc253570b75b789ff928c10323/debian/patches/streamline-Setup-with-new-defaults-and-add-new-Custom-option

Most users are not using Xplico at all.  Most of its functionality can be found in other tools.

We recently released our 14.04.5.5 ISO image and it no longer includes Xplico:
http://blog.securityonion.net/2017/11/elastic-stack-beta-2-release-and.html

Additionally, we recently made some changes to make it easier to totally remove the Xplico package from your existing system:
http://blog.securityonion.net/2017/11/securityonion-nsmnow-admin-scripts.html
http://blog.securityonion.net/2017/11/securityonion-iso-20151016.html
http://blog.securityonion.net/2017/11/securityonion-setup-20120912.html

To remove Xplico from your system, please follow the steps here:
https://securityonion.net/wiki/Xplico#removing

Security Advisory for Xplico 1.2.0

Introduction
Mehmet D. İNCE discovered several vulnerabilities related to Xplico. He identified three different vulnerabilities, two classified as "High severity" and one as "Medium severity". The CVE number assigned for these vulnerabilities is CVE-2017-16666:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16666

We've resolved these issues in a new Xplico package:
xplico - 1.2.0ubuntu1securityonion9

Resolution
To resolve these issues, simply install the new Xplico package according to our normal update instructions:
https://securityonion.net/wiki/Upgrade

Mitigations
Since 2015, our Setup wizard has disabled Xplico by default when choosing the "Best Practices" option:
https://github.com/Security-Onion-Solutions/securityonion-setup/blob/dd9c8e098af3e6bc253570b75b789ff928c10323/debian/patches/streamline-Setup-with-new-defaults-and-add-new-Custom-option

Since March 2016, our Setup wizard locks down the host-based firewall to block remote connections to Xplico:
http://blog.securityonion.net/2016/03/securityonion-setup-20120912.html

Additionally, we recently made some changes to make it easier to totally remove the Xplico package from your system:
http://blog.securityonion.net/2017/11/securityonion-nsmnow-admin-scripts.html
http://blog.securityonion.net/2017/11/securityonion-iso-20151016.html
http://blog.securityonion.net/2017/11/securityonion-setup-20120912.html

Future Security Onion ISO images will no longer include Xplico.

Thanks
Special thanks to Mehmet İNCE for responsibly disclosing this security issue per our Security page:
https://securityonion.net/security

Special thanks to Gianluca Costa for patching these issues so quickly!

Timeline
All times below are in Eastern time.
11/8/2017 2:32 AM - Received initial notification from Mehmet İNCE.
11/8/2017 6:30 AM - Confirmed receipt of email and confirmed issue.
11/8/2017 6:39 AM - Notified Gianluca Costa of Xplico.
11/13/2017 2:36 AM - Received patches from Gianluca Costa.
11/13/2017 8:56 AM - Built new Xplico package and sent to Mehmet İNCE for review.
11/13/2017 9:04 AM - Received confirmation from Mehmet İNCE.
11/13/2017 9:09 AM - Sent email to coordinate disclosure.

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion164 now available for Security Onion!

securityonion-nsmnow-admin-scripts - 20120724-0ubuntu0securityonion164 is now available and should resolve the following issues:

Issue 1162: NSM: Add new script to clear sensor backlog
https://github.com/Security-Onion-Solutions/security-onion/issues/1162

Issue 1167: NSM: need to handle /etc/init/securityonion.conf properly
https://github.com/Security-Onion-Solutions/security-onion/issues/1167

Issue 1168: NSM: check for /etc/init.d/xplico before trying to execute
https://github.com/Security-Onion-Solutions/security-onion/issues/1168

Thanks
Thanks to Wes Lambert for testing the new package!

Updating
Please see the following page for full update instructions:
https://securityonion.net/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
Security Onion Solutions offers onsite and online training!  For more information, please see:
https://securityonionsolutions.com

Support
Need support?  Please see:
https://securityonion.net/wiki/Support

Thanks!

Xplico 1.2.0 now available for Security Onion!

Thanks to Github user "bugcrash" for finding and reporting several segmentation faults in Xplico!  These issues have been resolved in Xplico 1.2.0:
https://github.com/xplico/xplico/releases/tag/v1.2.0

I've packaged Xplico 1.2.0 and nDPI 1.8 and the following packages are now available in our stable repo:
securityonion-ndpi - 1.8-1ubuntu1securityonion1
xplico - 1.2.0ubuntu1securityonion5

These new packages should resolve the following issues:

Xplico 1.2.0 #863
https://github.com/Security-Onion-Solutions/security-onion/issues/863

Segmentation fault /opt/xplico/bin/msite #1041
https://github.com/Security-Onion-Solutions/security-onion/issues/1041

Segmentation fault /opt/xplico/bin/trigcap #1045
https://github.com/Security-Onion-Solutions/security-onion/issues/1045

Segmentation fault /opt/xplico/bin/mfile #1046
https://github.com/Security-Onion-Solutions/security-onion/issues/1046

Segmentation fault /opt/xplico/bin/mfbc #1047
https://github.com/Security-Onion-Solutions/security-onion/issues/1047

Segmentation fault /opt/xplico/bin/mwebymsg #1048
https://github.com/Security-Onion-Solutions/security-onion/issues/1048

Segmentation fault /opt/xplico/bin/mwmail #1049
https://github.com/Security-Onion-Solutions/security-onion/issues/1049

Segmentation fault /opt/xplico/bin/xplico #1050
https://github.com/Security-Onion-Solutions/security-onion/issues/1050

Segmentation fault /opt/xplico/bin/mpaltalk #1051
https://github.com/Security-Onion-Solutions/security-onion/issues/1051

These packages have been tested by Wes Lambert.  Thanks, Wes!

Updating
These packages are now available in our stable repo.  Please see the following page for full update instructions:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Upgrade

Want to show your support for Security Onion?
Security Onion t-shirts are available in our CafePress store!
http://www.cafepress.com/securityonion/11820053

Training
Security Onion Solutions provides onsite, online, and on-demand training.  For more information, please see:
https://securityonionsolutions.com

Conference
Our annual Security Onion Conference will be Friday September 15, 2017:
https://securityonion.net/conference

Support
Need support?  Please see:
https://github.com/Security-Onion-Solutions/security-onion/wiki/Support

Thanks!

Security Onion 20111202 now available!

Security Onion 20111202 is now available!  This resolves the following issue:

Issue 139: Squert needs HTTPS

This update will convert Squert and Xplico to HTTPS.  It will also automatically update any Squert/Xplico shortcuts contained within the Security Onion installation to use HTTPS.  If you have any Squert/Xplico bookmarks on any other computers in your network, you should just need to change them from HTTP to HTTPS.

New Users

New users can download and install the 20111103 ISO image using the instructions here.  The step marked "Install Security Onion updates" will automatically install this update.

In-place Upgrade

Existing Security Onion users can perform an in-place upgrade using the following command (if you're behind a proxy, remember to set your proxy variables as described in the FAQ):

sudo -i "curl -L http://sourceforge.net/projects/security-onion/files/security-onion-upgrade.sh > ~/security-onion-upgrade.sh && bash ~/security-onion-upgrade.sh"

Note that the upgrade script is cumulative and will upgrade any older version of Security Onion to the most recent version (including any updates in between).

Screenshots

Upgrade Process