![](/images/new-backgrounds/1308409/308409295x1.webp)
Templates and Alerts
Buffer Overflow Template
Table |
| Execute on Stack Alert Properties (Continued) |
| |||
|
|
|
|
|
|
|
| Response |
| Alert | Alert |
|
|
| Program |
| Field | Alert Value/Format | Description | |
|
| Field | ||||
| Argument |
| Type |
|
| |
|
|
|
|
| ||
|
|
|
|
|
| |
| argv[3] | Severity | Integer | 1 | Critical Severity | |
|
|
|
|
|
| |
| argv[4] | UTC Time | Integer | <secs> | UTC time in number of | |
|
|
|
|
|
| seconds since epoch |
|
|
|
|
|
| when |
|
|
|
|
|
| was detected. |
|
|
|
|
|
| |
| argv[5] | Attacker | String | “uid=<uid>, gid=<gid>, pid=<pid>, | The user ID, group ID, | |
|
|
|
|
| ppid=<ppid>” | process ID, and parent |
|
|
|
|
|
| process ID of the process |
|
|
|
|
|
| that attempted to |
|
|
|
|
|
| execute on its stack |
|
|
|
|
|
| |
| argv[6] | Target of | String | “program=<full pathname>, | The full pathname of the | |
|
| Attack |
| mode=<mode>,uid=<uid>,gid=<gid> | program the attacker | |
|
|
|
|
| was running when | |
|
|
|
|
| , | |
|
|
|
|
| attempting to execute | |
|
|
|
|
|
| |
|
|
|
|
| inode=<inode>,device=<device>” | off the stack and the |
|
|
|
|
|
| program’s mode, uid, |
|
|
|
|
|
| gid, inode, and device |
|
|
|
|
|
| number |
|
|
|
|
|
| |
| argv[7] | Summary | String | “Buffer overflow detected” | Alert Summary | |
|
|
|
|
|
| |
| argv[8] | Details | String | “Buffer overflow detected by kernel | Detailed alert | |
|
|
|
|
| for process with pid <pid> and ppid | description |
|
|
|
|
| <ppid> when |
|
|
|
|
|
| executing<program>(type=<type>, |
|
|
|
|
|
| inode=<inode>, device=<device), |
|
|
|
|
|
| invoked with <args>” |
|
|
|
|
|
|
| |
| argv[9] | Local Time | Integer | <secs> | Local time in number of | |
|
|
|
|
|
| seconds since epoch |
|
|
|
|
|
| when |
|
|
|
|
|
| was detected |
|
|
|
|
|
|
|
|
|
| Refer to Table | |||
NOTE |
| |||||
|
|
| be used to access specific alert information (ie., pid, ppid) without having to parse the | |||
|
|
| string alert fields above. |
| ||
|
|
|
|
|
|
|
136 | Appendix A |