HP-UX Host Intrusion Detection System Version 4.3 administrator guide

Table A-5 Argument with Nonprintable Character Alert Properties (continued)
DescriptionAlert Value/FormatAlert Field
Type
Alert FieldResponse Program
Argument
The user ID, group ID, process
ID, and parent process ID of the
process that executed a
privileged setuid program
with an argument that contains
a nonprintable character
uid=<uid>, gid=<gid>,
pid=<pid>, ppid=<ppid>
StringAttackerargv[5]
The full path name of the
setuid program the attacker
executed with an argument that
contains a nonprintable character
and the program’s type mode,
uid, gid, inode, and device
number
file=<full pathname>,
type=<type>, mode=<mode>,
uid=<uid>, gid=<gid>,
inode=<inode>,
device=<device>
StringTarget of attackargv[6]
Alert summaryPotential buffer overflow
detected
StringSummaryargv[7]
Detailed alert descriptionPotential buffer overflow
attack by process with pid
<pid> and ppid <ppid> when
executing <program>(type=
<type>, inode=<inode>,
device=<device), invoked as
follows: <argv[0]><argv[1]>
contains non-printable
characters.
StringDetailsargv[8]
The event that triggered the
alert.
nullStringEventargv[9]
NOTE: Table B-1 (page 161) in Appendix B for the definition of additional arguments, that can
be used to access specific alert information (for example, pid and ppid) without parsing the string
alert fields above.
Limitations
The Buffer Overflow template has the following limitations:
• The template does not detect whether a buffer overflow attack was successful. It only detects
that one might have been attempted.
• The template only reports exec-on-stack buffer overflow attacks on HP-UX 11i when
exec-on-stack protection is enabled.
Race Condition Template
The vulnerability addressed by this template
Some attacks use the time between a program’s check of a file and the time that the program
uses that file. The race condition is sometimes referred to as the Time-To-Check-To-Time-To-Use
(TOCTTOU) vulnerability. For instance, a mail delivery program checks to see if a file exists
before it changes ownership of the file to the intended recipient. If an attack can change the file
reference between these two steps, it can cause the program to change the ownership of an
arbitrary file.
Certain TOCTTOU attacks against privileged setuid scripts use the time between the kernel
determining that program is a privileged script and spawns an interpreter with privilege, and
the interpreter opening the script to execute it. If an attacker can change the file reference between
these two steps, it can cause the interpreter to execute an arbitrary script with privilege. An
attacker can exploit the vulnerability by repeatedly executing a privileged setuid script with
Race Condition Template 125