HP-UX HIDS buffer overflow template not working

[MKaiser_1]

Hi,

has anybody managed to get the buffer overflow template working ?

I do not get any alerts if pass to long arguments or execute a command on the stack.

Thank you
Matthias

[Pierre Pasturel]

Hi Matthias -

0. If you have other templates running in your schedule in addition to the Buffer Overflow (BO) template, verify that your schedule is working by generating an alert for one of the other templates (Ex. Modification of Files/Dirs).

1. Are you running a setuid program that is owned by one of the privileged users specified in priv_user_list? Are you running the program as a non-privileged user?

2. What is the length of the longest argument and what is the value of the "unusual_arg_len" template property in your running schedule?

3. Please send the invocation of the setuid program(s) that you think should be triggering an alert.

4. For the execute-on-stack, do you have the executable_stack tunable kernel parameter enabled and did you run chatr on the setuid program to make sure it is not allowed to execute on stack? Is the program being killed as expected with the execute-on-stack protection?

Pierre

[MKaiser_1]

Hallo Pierre,

I finally got all templates working.

I forgot to turn on the execute-on-stack kernel flag and also to add the user to the privileged users list.

Thanks a lot !
Matthias

[Pierre Pasturel]

Hi Matthias - You're welcome. Glad you got it working. Let us know if this template ever generates false positives (or negatives) for you.

Pierre