HP Host Intrusion Detection System (HIDS) manual Appendix a 139

					Templates and Alerts
					Buffer Overflow Template
Table A-5		Argument with Non-printable Character Alert Properties (Continued)
	Response	Alert	Alert
	Program			Alert Value/Format	Description
		Field	Field Type
	Argument
	argv[3]	Severity	Integer	1	Critical severity
	argv[4]	UTC Time	Integer	<secs>	UTC time in
					number of seconds
					since epoch when
					a privileged setuid
					program was run
					with an argument
					that contains a
					non-printable
					character
	argv[5]	Attacker	String	“uid=<uid>, gid=<gid>, pid=<pid>,	The user ID, group
				ppid=<ppid>”	ID, process ID,
					and parent
					process ID of the
					process that
					executed a
					privileged setuid
					program with an
					argument that
					contains a
					non-printable
					character
	argv[6]	Target of	String	“file=<full pathname>,	The full pathname
		Attack		mode=<mode>,uid=<uid>,gid=<gid>,	of the setuid
					program the
				inode=<inode>,device=<device>”	attacker executed
					with an argument
					that contains a
					non-printable
					character and the
					program’s mode,
					uid, gid, inode,
					and device
					number.
	argv[7]	Summary	String	“Potential Buffer overflow detected”	Alert summary
	argv[8]	Details	String	“Potential buffer overflow attack by	Detailed alert
				process with pid <pid> and ppid <ppid>	description
				when executing<program>(type=<type>,
				inode=<inode>, device=<device), invoked
				as follows: "<argv[0><argv[1]..." contains
				non-printable character(s).”

Appendix A 139