![](/images/new-backgrounds/1308409/308409299x1.webp)
Templates and Alerts
Buffer Overflow Template
Table | Unusual Argument Length Alert Properties (Continued) | |||||
|
|
|
|
|
|
|
| Response |
|
| Alert |
|
|
| Program |
| Alert Field | Field | Alert Value/Format | Description |
| Argument |
|
| Type |
|
|
|
|
|
|
|
|
|
| argv[8] |
| Details | String | “Potential buffer overflow attack | Detailed alert |
|
|
|
|
| by process with pid <pid> and | description |
|
|
|
|
| ppid <ppid> when |
|
|
|
|
|
| executing<program>(type=<type |
|
|
|
|
|
| >, inode=<inode>, |
|
|
|
|
|
| device=<device), invoked as |
|
|
|
|
|
| follows: "<argv[0><argv[1]..." |
|
|
|
|
|
| Length of the longest argument |
|
|
|
|
|
| is <value> which surpasses the |
|
|
|
|
|
| longest expected argument |
|
|
|
|
|
| length of <unusual_arg_len>. |
|
|
|
|
|
| Total length of argument is |
|
|
|
|
|
| <value>.” |
|
|
|
|
|
|
|
|
| argv[9] |
| Local Time | Integer | <secs> | Local time in number |
|
|
|
|
|
| of seconds since |
|
|
|
|
|
| epoch when a |
|
|
|
|
|
| privileged setuid |
|
|
|
|
|
| program was run |
|
|
|
|
|
| with an unusually |
|
|
|
|
|
| long program length |
|
|
|
|
|
|
|
|
|
| Refer to Table | |||
NOTE | ||||||
|
|
| be used to access specific alert information (i.e., pid, ppid) without having to parse the | |||
|
|
| string alert fields above. |
|
| |
|
|
|
|
|
|
|
Argument with Non-printable Character
This template generates and forwards the following alert to a response program when a privileged setuid program was invoked with an argument that contains a
Table | Argument with | ||||
|
|
|
|
|
|
| Response | Alert | Alert |
|
|
| Program | Alert Value/Format | Description | ||
| Field | Field Type | |||
| Argument |
|
| ||
|
|
|
|
| |
|
|
|
|
|
|
| argv[1] | Template | Integer | 0 | Unique code |
|
| code |
|
| assigned to |
|
|
|
|
| template |
|
|
|
|
|
|
| argv[2] | Version | Integer | 2 | Version of the |
|
|
|
|
| template |
|
|
|
|
|
|
138 | Appendix A |