Skip to content

Commit 8907280

Browse files
committed
Oops, markdown fix, thanks @Zenofex
Signed-off-by: Tod Beardsley <todb@packetfu.com>
1 parent 1f33055 commit 8907280

File tree

2 files changed

+2
-0
lines changed

2 files changed

+2
-0
lines changed

cves/CVE-2023-0667.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -277,6 +277,7 @@ Ex4JdM76C7DO+guwTU1TDXr/igDv/9+KigEAAA0BAAAEAAAAAgADAAAAAAAAAAABN
277277
AAYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA2wAa29vb29vb29vbEz4JAc4H
278278
```
279279
<br/>
280+
280281
# Attacker Value
281282

282283
Passing the above blob to fuzzshark will trigger a heap overflow, and any crash in fuzzshark is necessarily is a bug in Wireshark library code, including the Wireshark GUI application and TShark, as they all hit the same code paths. Therefore, we're confident that a specially crafted MSMSS packet that implements this crash behavior is exploitable.

cves/CVE-2023-0668.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,6 +94,7 @@ AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAA
9494
BRQkgUAAD3EwD/AAAAAAAAAAAAIQAAABERAQD///8AAA==
9595
```
9696
<br/>
97+
9798
# Attacker Value
9899

99100
By providing this poisoned IEEE C37.118 packet, an attacker could hijack the user account of an analyst running Wireshark. Many security appliances capture packets as a matter of course for later analysis, and Wireshark is a common tool used by incident responders. So, it would be trivial for an attacker to intentionally "get caught" in order to provide their malicious packet to an incident response analyst. Once compromised, this can provide an attacker a unique, privileged position in the targeted network.

0 commit comments

Comments
 (0)