HP-UX Host Intrusion Detection System Version 4.3 administrator guide

NOTE: In HP-UX 11i v2 and later, comprehensive stack buffer overflow protection, which uses
a combination of highly efficient software and existing memory management hardware, protects
against both known and unknown buffer overflow attacks without sacrificing system performance.
This protection is managed with the executable_stack tunable kernel parameter. You can
allow selected programs to execute from the stack by marking them with the -es option of the
chatr command. Refer to executable_stack (5) and chatr (1) manpages and the Stack
Buffer Overflow Protection in HP-UX 11i white paper, available at http://www.docs.hp.com.
How this template is configured
Table A-2 lists the configurable properties the Buffer Overflow template supports.
Table A-2 Buffer Overflow Template Properties
Default ValueTypeProperty
root | daemon | bin | sys | adm | uucp |
lp | nuucp
III
priv_user_list
500VIII
unusual_arg_len
<empty>I
programs_to_not_watch
priv_user_list A list of system-level user IDs or users names.
Include users who have elevated access to the system to this
list. Only programs that run with an effective user ID that
equals one of the listed user IDs or corresponds to one of the
listed user names are monitored for the use of unusually long
arguments or arguments with nonprintable characters. For
higher security, add the user IDs and user names of other
privileged accounts (for example, Webmaster or news
administrator), and do not remove the default user IDs.
unusual_arg_len
An integer value set to an unusually long argument length.
Configure this property value can be to an unusually long
argument length for privileged setuid executables run on the
system, which can indicate a buffer overflow attack.
programs_to_not_watch
Path names of programs that can be safely ignored.
Any buffer overflow alert for a program with a path name is
matched by a regular expression in this property will be filtered
out and not reported.
Alerts generated by this template
The following alerts are generated by the Buffer Overflow template:
• “Execute on Stack” (page 122)
• “Unusual Argument Length” (page 123)
• “Argument with Nonprintable Character” (page 124)
Execute on Stack
Table A-3 lists the alerts that this template generates and forwards to a response program when
an execute-on-stack condition is detected by the HP-UX 11i kernel.
122 Templates and Alerts