diff --git a/SecurityExploits/Facebook/Fizz/CVE-2019-3560/README.md b/SecurityExploits/Facebook/Fizz/CVE-2019-3560/README.md index 60c81c3..09dcb31 100644 --- a/SecurityExploits/Facebook/Fizz/CVE-2019-3560/README.md +++ b/SecurityExploits/Facebook/Fizz/CVE-2019-3560/README.md @@ -1,6 +1,6 @@ # Remote DOS in Facebook Fizz (CVE-2019-3560) -[Fizz](https://github.com/facebookincubator/fizz) contains a remotely triggerable infinite loop. It is due to an integer overflow in this [compound assignment](https://github.com/facebookincubator/fizz/blob/eaa81af854bef509c3c1d7c83df0cd0b084a0fef/fizz/record/PlaintextRecordLayer.cpp#L42). For more details about the bug, see this [blog post](https://lgtm.com/blog/facebook_fizz_CVE-2019-3560). +[Fizz](https://github.com/facebookincubator/fizz) contains a remotely triggerable infinite loop. It is due to an integer overflow in this [compound assignment](https://github.com/facebookincubator/fizz/blob/eaa81af854bef509c3c1d7c83df0cd0b084a0fef/fizz/record/PlaintextRecordLayer.cpp#L42). For more details about the bug, see this [blog post](https://securitylab.github.com/research/facebook-fizz-CVE-2019-3560). The scenario for the demo is that there are two computers, named "fizz-server" and "fizz-attacker". The attacker sends a malicious message which triggers an infinite loop on the server. The demo uses [docker](https://www.docker.com/) to simulate the two computers. See below for instructions.