IDS 9000 alert for buffer overflow

[Krishnan Viswanathan]

I receive an alert everytime an ftp client session begins :

Example :
=========================================
Unexpected change in privilege levels with UID:2164(GID:0) EUID:2164(EGID:20) executing /usr/lbin/ftpd(1,14697,"40000007") with arguments["ftpd", "-l", "-a"] and system call kern_unlink as PID:25701
=====================================

Also, I receive one alert for every command executed by that particular ftp session

This is being caused by the "buffer overflow" template. The template does'nt have any modification options. Is there some safe way to supress these messages ? (May be in the idsconf file or elsewhere ?)

Thanks
-Krishnan

[Pierre Pasturel · Accepted solution]

Krishnan -

No, HIDS (IDS/9000) does not currently have a way to suppress these alerts.

I believe the alert you are getting is caused by a defect in the BO template for HIDS v1.0 and v2.x. HIDS v3.0, which is coming out in the 2nd half of 2004, will have a completely revamped BO template which should perform MUCH better and have better heuristics and filtering capabilities. I would not use the BO template that comes with HIDS v2.x.

If your system is HP-UX 11i (11.11) or later, I would recommend using the kernel exec-on-stack buffer overflow protection (see the chatr(2) man page for details).

Pierre

[Krishnan Viswanathan]

Pierre,

Thank you for the clarification. I am hoping to see some filtering abilites in the HIDS 3.0 for the BO template.

I have few more questions for you :

a) Does the lab have a beta version of HIDS 3.0?

b) Whenever certain applications are executed (for example "glance" ), the cpu utilisation for "idscor" and "idssysdsp" spikes upto 20 % for a period of about 1-2 minutes. Is there a way to tell IDS to ignore certain binaries/applications from checks altogether?

c) Is HP even remotely considering releasing a version of HIDS for RedHat Linux/SUN and other OS ? I am aware that IDS is pretty much kernel/host specific but our management was just looking into the possibility of one common HOST intrusion detection product for various platforms. Any suggestions?

Thanks
-Krishnan

[Pierre Pasturel]

Hi Krishnan -

a) Does the lab have a beta version of HIDS 3.0?

We will have a beta version sometime this summer. Let me know if you are interested in participating. If you give me permission, I can ask the ITRC forum manager to pass along your email address so I can contact you directly.

b) Whenever certain applications are executed (for example "glance" ), the cpu utilisation for "idscor" and "idssysdsp" spikes upto 20 % for a period of about 1-2 minutes. Is there a way to tell IDS to ignore certain binaries/applications from checks altogether?

There is not. Actually, we hope that the next version of IDS will address the CPU utilization, although we are primarily concentrating on improving event throughput. The next version of the BO template will provide the ability to filter out alerts based on a program's pathname, in addition to being less CPU intensive.

c) Is HP even remotely considering releasing a version of HIDS for RedHat Linux/SUN and other OS ? I am aware that IDS is pretty much kernel/host specific but our management was just looking into the possibility of one common HOST intrusion detection product for various platforms. Any suggestions?

We are not considering Solaris or Windows at this time, although we might reconsider Solaris if we have a supported public interface to their kernel auditing system. We have looked into Linux, but we will not be doing a port in the near future.

Pierre

[Krishnan Viswanathan]

Thank you. Yes, I would be willing to evaluate the upcoming beta release in our test environment