[Snort-users] is acid 0.9.6b22 missing reference for url sigs ?

jay.archibald at ...7650... jay.archibald at ...7650...
Mon Dec 2 12:28:32 EST 2002

I have recently installed ACID 0.9.6b22 and have noticed the same problem.
The reference for 'URL', 'BUGTRAC', 'CVE', 'ARACHNIDS' show up, but there is
no link created to the actual reference, just text.  The interesting thing
though is that 'SNORT' references have links and work fine, but they are the
only reference with a link.

I have installed acid three times with the same results.

The following is copied from my "acid_conf.php" file:

/* Signature references */
$external_sig_link = array("bugtraq"   =>
array("http://www.securityfocus.com/bid/", ""),
                           "snort"     =>
array("http://www.snort.org/snort-db/sid.html?sid=", ""),
                           "cve"       =>
array("http://cve.mitre.org/cgi-bin/cvename.cgi?name=", ""),
                           "arachnids" =>
array("http://www.whitehats.com/info/ids", ""),
                           "mcafee"    =>
array("http://vil.nai.com/vil/content/v_", ".htm"),
                           "icat"      =>
array("http://icat.nist.gov/icat.cfm?cvename=", ""));

It appears that these links should be created, but again only the "snort"
links are the only ones being created.

If anyone can come up with a reason why, I am interested in a solution.  In
the meantime, I have found that I can go to SNORTCENTER and look up the rule
and get the link there.  It is just annoying to take those extra steps.


Jay Archibald

>I just upgraded to acid 0.9.6b22 and noticed some nice things:

>automatic snort sig refrences (thanks).

>But I also noticed that it looks like 'url' refrences are missing.

>I looked in an old version of acid_signature.inc and found it there, but
>in the 0.9.6b22, I didn't find it.

>Now when looking at acid detail, I see sigs for a lot of new things (snort
>id, icat) but the reference for url us just 'url' with no link.

>Michael Scheidell, CEO
>SECNAP Network Security, LLC 
>Sales: 866-SECNAPNET / (1-866-732-6276)
>Main: 561-368-9561 / www.secnap.net
>Looking for a career in Internet security?

More information about the Snort-users mailing list