HP-UX Host Intrusion Detection System Version 4.3 administrator guide

a symbolic link, where the symbolic link is constantly being changed from pointing to the
privileged script to pointing to the attacker’s own attack script. Starting with HP-UX 11i v1.6, a
kernel tunable parameter called secure_sid_scripts (5) was introduced with a default value
that indicates that the setuid and setgid bits on scripts are ignored by the kernel. The
vulnerability can also be exploited if the tunable parameter is configured to honor a privileged
script’s setuid and setgid bits in favor of compatibility over security. Refer to the
secure_sid_scripts (5) for details.
How this template addresses the vulnerability
The Race Condition template monitors the file accesses that privileged programs make. The
template generates an alert if a file reference appears to have unexpectedly changed.
This template also monitors the execution of privileged setuid scripts, that are susceptible to
a race condition when executed from a symbolic link. Starting with HP-UX 11i v1.6, the setuid
bit of a setuid script is ignored if the default value of the secure_sid_scripts tunable
kernel parameter is in place.
How this template is configured
Table A-6 lists the configurable properties the Race Condition template supports.
Table A-6 Race Condition Template Properties
Default ValueTypeProperty
root | daemon | bin | sys | adm |
uucp | lp | nuucp
III
priv_user_list
<empty>I
pathnames_to_not_watch
^/etc/passwd$II
pathnames_1
^/usr/bin/passwd$ &
^/usr/sbin/useradd$ &
^/usr/sbin/userdel$ &
^/usr/sbin/usermod$
II
programs_1
<empty>II
pathnames_X
<empty>II
programs_X
Properties
The properties of the Race Condition template are described as follows:
priv_user_list
A list of system-level user IDs or user names.
This list contains those users who have elevated access to
the system. Removing any of these users mean that an attack
against one of them is not detected by this template. Only
programs that run with an effective user ID equal to one of
the listed uids or corresponds to the one of the listed user
names are monitored, and only the execution of setuid
scripts owned by a user listed in this property generates an
alert.
pathnames_to_not_watch
Path names of programs that can be safely ignored.
Any race condition alert for a file whose path name is
matched by a regular expression in the
pathnames_to_not_watch property is filtered out and
not reported. You can use this property to filter alerts
generated when a privileged setuid script is executed. You
must specify the full path name of the script.
126 Templates and Alerts