[Snort-users] BASE1.4.4 is not working properly

Jun Wan

unread,

Jun 10, 2010, 10:40:11 PM6/10/10

to

Hi

My Snort 2.8.5.2 (Build 121) with Barnyars2 (BASE1.4.4) on Ubundu9.1 was running beautifully until I upgraded Ubundu9.1 to 10.1 without modifying any existing Snort related configuration files last week.

The Snort is running fine, but now I am having trouble with BASE. I am still able to login BASE via a browser, and "Basic Analysis and Security Engine" (BASE) page shows up with following lines above the BASE:
properly

Deprecated: Function ereg_replace() is deprecated in /var/www/base-1.4.4/includes/base_state_common.inc.php
on line 184

Deprecated: Function ereg_replace() is deprecated in /var/www/base-1.4.4/includes/base_state_criteria.inc.php
on line 255

Deprecated: Function ereg_replace() is deprecated in /var/www/base-1.4.4/includes/base_state_common.inc.php
on line 184

When I try to access any more information, I get the following error:

Fatal error: Call to undefined method
ProtocolFieldCriteria::ProtocolFieldCriteria() in /var/www/base-1.4.4/includes/base_state_citems.inc.php
on line 1113

After "Google", I got the following suggestion:

Use Base-1.4.5 to resolve the problem

My questions would be:

1.) What is the easiest way to upgrade Base from 1.4.4 to 1.4.5? Is there any info for my answer? I want to upgrade BASE properly, I don't want to muck up my "working snort" .
2.) Is Base-1.4.5 the remedy for my problem? If it's not, then what's your suggestion?

Many thanks in advance.

Any info and help would be much appreciated.

Regards

John

_________________________________________________________________
New, Used, Demo, Dealer or Private? Find it at CarPoint.com.au
http://clk.atdmt.com/NMN/go/206222968/direct/01/
------------------------------------------------------------------------------
ThinkGeek and WIRED's GeekDad team up for the Ultimate
GeekDad Father's Day Giveaway. ONE MASSIVE PRIZE to the
lucky parental unit. See the prize list and enter to win:
http://p.sf.net/sfu/thinkgeek-promo
_______________________________________________
Snort-users mailing list
Snort...@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users

Kevin Johnson

unread,

Jun 11, 2010, 1:20:04 AM6/11/10

to

Please upgrade to BASE 1.4.5. It fixes this issue.

Thanks
Kevin

On Jun 10, 2010, at 10:40 PM, Jun Wan wrote:

>
> Hi
>
> My Snort 2.8.5.2 (Build 121) with Barnyars2 (BASE1.4.4) on Ubundu9.1 was running beautifully until I upgraded Ubundu9.1 to 10.1 without modifying any existing Snort related configuration files last week.
>
> The Snort is running fine, but now I am having trouble with BASE. I am still able to login BASE via a browser, and "Basic Analysis and Security Engine" (BASE) page shows up with following lines above the BASE:
> properly
>
>
> Deprecated: Function ereg_replace() is deprecated in /var/www/base-1.4.4/includes/base_state_common.inc.php
> on line 184

olli hauer

unread,

Jun 11, 2010, 4:24:23 AM6/11/10

to

> On Jun 10, 2010, at 10:40 PM, Jun Wan wrote:
>> Hi
>>
>> My Snort 2.8.5.2 (Build 121) with Barnyars2 (BASE1.4.4) on Ubundu9.1 was running beautifully until I upgraded Ubundu9.1 to 10.1 without modifying any existing Snort related configuration files last week.
>>
>> The Snort is running fine, but now I am having trouble with BASE. I am still able to login BASE via a browser, and "Basic Analysis and Security Engine" (BASE) page shows up with following lines above the BASE:
>> properly
>>
>>
>> Deprecated: Function ereg_replace() is deprecated in /var/www/base-1.4.4/includes/base_state_common.inc.php
>> on line 184
>
>
On 2010-06-11 07:20, Kevin Johnson wrote:
> Please upgrade to BASE 1.4.5. It fixes this issue.
>

No, those deprecated functions are not fixed in base-1.4.5, but I submitted some
patches for base-1.4.5.

To fix this issue apply the patch patch_base_1.4.5_php5.3.txt which you can find
here
http://sourceforge.net/tracker/?func=detail&aid=3009648&group_id=103348&atid=635584

Additional if you are using php5.3

change the following line in base_graph_display.php
--- ./base_graph_display.php.orig 2010-03-05 16:06:17.000000000 +0100
+++ ./base_graph_display.php 2010-04-11 23:52:13.000000000 +0200
@@ -114,7 +114,7 @@
else
{
// Create the graph area, legends on bottom -- Alejandro
- $Graph =& new Image_Graph(array('driver'=>'gd',
+ $Graph = new Image_Graph(array('driver'=>'gd',
'width'=>$width,
'height'=>$height));
}

If graphs are not displayed properly (php5.3) you have to fix all the pear stuff
(replace ereg_... with preg_..., replace '=& new' with '= new' ...)

Cheers,
olli

Kevin Johnson

unread,

Jun 11, 2010, 7:07:24 AM6/11/10

to

On Jun 11, 2010, at 4:24 AM, olli hauer wrote:
>> On Jun 10, 2010, at 10:40 PM, Jun Wan wrote:
>>> Hi
>>>
>>> My Snort 2.8.5.2 (Build 121) with Barnyars2 (BASE1.4.4) on Ubundu9.1 was running beautifully until I upgraded Ubundu9.1 to 10.1 without modifying any existing Snort related configuration files last week.
>>>
>>> The Snort is running fine, but now I am having trouble with BASE. I am still able to login BASE via a browser, and "Basic Analysis and Security Engine" (BASE) page shows up with following lines above the BASE:
>>> properly
>>>
>>>
>>> Deprecated: Function ereg_replace() is deprecated in /var/www/base-1.4.4/includes/base_state_common.inc.php
>>> on line 184
>>
>>
> On 2010-06-11 07:20, Kevin Johnson wrote:
>> Please upgrade to BASE 1.4.5. It fixes this issue.
>>
>
> No, those deprecated functions are not fixed in base-1.4.5, but I submitted some
> patches for base-1.4.5.
>

You are correct. I got messed up because I was reviewing your patch.

I will be trying to get that into CVS next week since I will be home from the road.

Thanks!
Kevin