From a5cd821001f3b73dbd30f9fe1a1fdb7ac05f7a91 Mon Sep 17 00:00:00 2001 From: Xavier RENE-CORAIL Date: Wed, 20 Nov 2019 13:58:18 -0800 Subject: [PATCH] Update README.md --- SecurityExploits/Facebook/Fizz/CVE-2019-3560/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/SecurityExploits/Facebook/Fizz/CVE-2019-3560/README.md b/SecurityExploits/Facebook/Fizz/CVE-2019-3560/README.md index 60c81c3..09dcb31 100644 --- a/SecurityExploits/Facebook/Fizz/CVE-2019-3560/README.md +++ b/SecurityExploits/Facebook/Fizz/CVE-2019-3560/README.md @@ -1,6 +1,6 @@ # Remote DOS in Facebook Fizz (CVE-2019-3560) -[Fizz](https://github.com/facebookincubator/fizz) contains a remotely triggerable infinite loop. It is due to an integer overflow in this [compound assignment](https://github.com/facebookincubator/fizz/blob/eaa81af854bef509c3c1d7c83df0cd0b084a0fef/fizz/record/PlaintextRecordLayer.cpp#L42). For more details about the bug, see this [blog post](https://lgtm.com/blog/facebook_fizz_CVE-2019-3560). +[Fizz](https://github.com/facebookincubator/fizz) contains a remotely triggerable infinite loop. It is due to an integer overflow in this [compound assignment](https://github.com/facebookincubator/fizz/blob/eaa81af854bef509c3c1d7c83df0cd0b084a0fef/fizz/record/PlaintextRecordLayer.cpp#L42). For more details about the bug, see this [blog post](https://securitylab.github.com/research/facebook-fizz-CVE-2019-3560). The scenario for the demo is that there are two computers, named "fizz-server" and "fizz-attacker". The attacker sends a malicious message which triggers an infinite loop on the server. The demo uses [docker](https://www.docker.com/) to simulate the two computers. See below for instructions.