HP Host Intrusion Detection System (HIDS) manual 136

Templates and Alerts

Buffer Overflow Template

Table A-3			Execute on Stack Alert Properties (Continued)
	Response		Alert	Alert
	Program			Field	Alert Value/Format	Description
			Field
	Argument			Type
	argv[3]	Severity		Integer	1	Critical Severity
	argv[4]	UTC Time		Integer	<secs>	UTC time in number of
						seconds since epoch
						when execute-on-stack
						was detected.
	argv[5]	Attacker		String	“uid=<uid>, gid=<gid>, pid=<pid>,	The user ID, group ID,
					ppid=<ppid>”	process ID, and parent
						process ID of the process
						that attempted to
						execute on its stack
	argv[6]	Target of		String	“program=<full pathname>,	The full pathname of the
		Attack			mode=<mode>,uid=<uid>,gid=<gid>	program the attacker
						was running when
					,
						attempting to execute
					inode=<inode>,device=<device>”	off the stack and the
						program’s mode, uid,
						gid, inode, and device
						number
	argv[7]	Summary		String	“Buffer overflow detected”	Alert Summary
	argv[8]	Details		String	“Buffer overflow detected by kernel	Detailed alert
					for process with pid <pid> and ppid	description
					<ppid> when
					executing<program>(type=<type>,
					inode=<inode>, device=<device),
					invoked with <args>”
	argv[9]	Local Time		Integer	<secs>	Local time in number of
						seconds since epoch
						when execute-on-stack
						was detected
			Refer to Table B-1 in Appendix B for the definition of argv[10] through argv[32] that can
NOTE
			be used to access specific alert information (ie., pid, ppid) without having to parse the
			string alert fields above.

136 Appendix A