8.0 Upgrade damaged SnortSnarf...

"Stone, David" <[email protected]> Tue, 25 Feb 2003 06:05:08 -0500
Newsgroups gmane.comp.security.ids.snort.snarf
Message-ID <[email protected]>
Was able to fix 90% of my problems after the upgrade but
still cannot get annotations and SISR to function.  This 
one has got me really stumped... Pipeline.pl is returning 
the following information:  (latest version of pipeline.

/var/www/cgi-bin\&_pipeline=config_inc_flds_db.pl is not a valid path
component;
path components may only contain only the following characters:
	letters, numbers, _, -, ., and /
------------------------------------------------------------
The environmental variables were:
DOCUMENT_ROOT: /var/www/html
GATEWAY_INTERFACE: CGI/1.1
HTTP_ACCEPT: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword,
application/x-shockwave-flash, */*
HTTP_ACCEPT_ENCODING: gzip, deflate
HTTP_ACCEPT_LANGUAGE: en-us
HTTP_CONNECTION: Keep-Alive
HTTP_HOST: myserver.com
HTTP_REFERE http://myserver.com/slytherin2/header.html
HTTP_USER_AGENT: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
PATH: /sbin:/usr/sbin:/bin:/usr/bin:/usr/X11R6/bin
QUERY_STRING:
_path=%2Fvar%2Fwww%2Fcgi%2Dbin%2Fslytherin2%20%2Fvar%2Fwww%2Fcgi%2Dbin&_pipe
line=config_inc_flds_db.pl%20%2FLOG2%2FIDS_ROOT%2Fslytherin2%2Fincidents%2Fs
lytherin2%2Dsisr.config%20%24ifieldinfo%20%24incfile%20%7C%20inc_list_view.p
l%20%24incfile&configfile=%2FLOG2%2FIDS_ROOT%2Fslytherin2%2Fincidents%2Fslyt
herin2%2Dsisr.config
REMOTE_ADDR: xxx.xxx.xxx.xxx
REMOTE_HOST: myhost.com
REMOTE_PORT: 1338
REQUEST_METHOD: GET
REQUEST_URI:
/cgi-bin/pipeline.pl?_path=%2Fvar%2Fwww%2Fcgi%2Dbin%2Fslytherin2%20%2Fvar%2F
www%2Fcgi%2Dbin&_pipeline=config_inc_flds_db.pl%20%2FLOG2%2FIDS_ROOT%2Fslyth
erin2%2Fincidents%2Fslytherin2%2Dsisr.config%20%24ifieldinfo%20%24incfile%20
%7C%20inc_list_view.pl%20%24incfile&configfile=%2FLOG2%2FIDS_ROOT%2Fslytheri
n2%2Fincidents%2Fslytherin2%2Dsisr.config
SCRIPT_FILENAME: /var/www/cgi-bin/pipeline.pl
SCRIPT_NAME: /cgi-bin/pipeline.pl
SERVER_ADDR: xxx.xxx.xxx.xxx
SERVER_ADMIN: [email protected]
SERVER_NAME: myserver
SERVER_PORT: 80
SERVER_PROTOCOL: HTTP/1.1
SERVER_SIGNATURE: <address>Apache/2.0.40 Server at myserver.com Port
80</address>

SERVER_SOFTWARE: Apache/2.0.40 (Red Hat Linux)
UNIQUE_ID: XXxaSAqR-iwAAANVBMEAAAAC
------------------------------------------------------------
And the fields were:
_path: /var/www/cgi-bin/slytherin2
/var/www/cgi-bin\&_pipeline=config_inc_flds_db.pl
/LOG2/IDS_ROOT/slytherin2/incidents/slytherin2-sisr.config \$ifieldinfo
\$incfile \| inc_list_view.pl
\$incfile\&configfile=/LOG2/IDS_ROOT/slytherin2/incidents/slytherin2-sisr.co
nfig
_pipeline: config_inc_flds_db.pl
/LOG2/IDS_ROOT/slytherin2/incidents/slytherin2-sisr.config $ifieldinfo
$incfile | inc_list_view.pl $incfile
configfile: /LOG2/IDS_ROOT/slytherin2/incidents/slytherin2-sisr.config