ACID Search not working properly

[Kevin Brown <Kevin.M.Brown () asu edu>]

Someone tried to crack into my Windows Domain Server.  I was trying to use
the search feature of ACID to find any alerts going to the machine, but when
I searched for the IP address I got back all the alerts in the database
(435,000) and they were not all going to/from that machine (most weren't in
fact).  It appeared to return any alert with an address that had any
matching octet (even when performing the search with xxx.xxx.xxx.xxx/32).

I checked the apache error logs and found:

[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 846
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 846
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined index:   in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 846
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 847
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 847
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined offset:  1 in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 847
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 848
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 848
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined offset:  2 in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 848
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 849
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 849
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined offset:  3 in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 849
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 850
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 850
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined offset:  4 in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 850
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 851
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 851
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined offset:  5 in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 851
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 852
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 852
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined offset:  6 in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 852
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 853
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 853
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined offset:  7 in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 853
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 854
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 854
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined offset:  8 in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 854
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 855
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 855
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined offset:  9 in
/home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 855
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
0 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
1 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
2 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
3 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
4 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
5 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
0 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
1 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
2 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
3 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
4 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
5 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
0 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
1 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
2 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
3 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
4 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
5 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
0 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
1 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
2 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
3 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
4 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
5 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
0 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
1 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
2 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
3 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
4 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
5 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
[Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
0 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 398


Webserver is:

PHP 4.2.3 (tried it with both registered globals on and off)
MySQL 3.23.51
Apache 1.3.22 (patched)
ACID 0.9.6b22 (last checked out last week)