Re: ACID Search not working properly

[Roman Danyliw <roman () danyliw com>]

Kevin,

There was a bug in the input validation code.  I have committed a
patch for this problem.  Update from CVS again.

Roman

On Mon, 16 Sep 2002, Kevin Brown wrote:

> Someone tried to crack into my Windows Domain Server.  I was trying to use
> the search feature of ACID to find any alerts going to the machine, but when
> I searched for the IP address I got back all the alerts in the database
> (435,000) and they were not all going to/from that machine (most weren't in
> fact).  It appeared to return any alert with an address that had any
> matching octet (even when performing the search with xxx.xxx.xxx.xxx/32).
>
> I checked the apache error logs and found:
>
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 846
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 846
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined index:   in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 846
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 847
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 847
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined offset:  1 in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 847
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 848
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 848
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined offset:  2 in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 848
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 849
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 849
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined offset:  3 in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 849
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 850
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 850
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined offset:  4 in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 850
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 851
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 851
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined offset:  5 in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 851
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 852
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 852
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined offset:  6 in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 852
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 853
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 853
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined offset:  7 in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 853
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 854
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 854
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined offset:  8 in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 854
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 855
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined variable:  i in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 855
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Undefined offset:  9 in
> /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 855
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 0 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 1 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 2 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 3 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 4 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 5 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 0 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 1 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 2 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 3 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 4 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 5 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 0 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 1 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 2 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 3 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 4 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 5 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 0 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 1 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 2 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 3 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 4 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 5 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 0 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 1 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 2 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 3 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 4 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 5 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 177
> [Mon Sep 16 09:29:46 2002] [error] PHP Notice:  Uninitialized string offset:
> 0 in /home/httpd/html/tcs/snort/acid37/acid_state_citems.inc on line 398
>
>
> Webserver is:
>
> PHP 4.2.3 (tried it with both registered globals on and off)
> MySQL 3.23.51
> Apache 1.3.22 (patched)
> ACID 0.9.6b22 (last checked out last week)



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users