Bug #14469
closed
Snort Advanced config pass-through encodes entries
Added by Alex Tatistcheff almost 2 years ago.
Updated almost 2 years ago.
Affected Architecture:
i386
Description
When attempting to add a custom snort.conf config line using the Snort Advanced Configuration Pass-Through feature, the contents of the text box become encoded. This text is then inserted into the snort.conf causing the app to fail on start up. Screenshots show the command entered before clicking the Save button, after the save button and the entry in snort.conf.
Files
I was able to replicate this issue. It is caused by a misplaced early Base64 decode of a config parameter. A fix will be in the next Snort GUI package update.
In the meantime, if you want to implement a temporary fix, then make the following edit to the indicated PHP source file.
In /usr/local/snort/www/snort/snort_interfaces_edit.php
find the code section shown below starting on line 136:
$pconfig = $a_rule[$id];
if (!empty($pconfig['configpassthru']))
$pconfig['configpassthru'] = base64_decode($pconfig['configpassthru']);
if (empty($pconfig['uuid']))
Comment out 137 and 138 as shown below and save the change:
$pconfig = $a_rule[$id];
// if (!empty($pconfig['configpassthru']))
// $pconfig['configpassthru'] = base64_decode($pconfig['configpassthru']);
if (empty($pconfig['uuid']))
- Status changed from New to Resolved
- % Done changed from 0 to 100
Also available in: Atom
PDF