3 ms·

Hrm. Interesting point. There have been a fair number of parser CVEs, but GoLang isn't immune to some of the (based on an admittedly cursory look) parser issues

Hrm. Interesting point. There have been a fair number of parser CVEs, but GoLang isn't immune to some of the (based on an admittedly cursory look) parser issues.

tptacek 4y ago
A protocol analyzer implemented in anything short of formally-verified code is going to be "vulnerable" to logic errors, such that it might print (or not print) the wrong things. But a protocol analyzer implemented in C standard a decent chance of coughing up RCE.
- T3OU-736 4y ago
  (Playing devil's advocate): What would the RCE accomplish? "Parse this packet and get a reverse shell on analyst's workstation?" To be clear: I am not in any way attempting to disparage the project. It is damned cool, and as a neophyte Go practitioner myself, I very much appreciate its existance and utility. Just working through all the edge cases :)
  - tptacek 4y ago
    Yes, that's what it would accomplish.
  - jpalomaki 4y ago
    I assume one reason for these console versions is that people run them directly on the server. Maybe sometimes even as root.