Re: Work-in-progress package to detect CVE-2020-0601

Aashish Sharma <[email protected]> Tue, 14 Jan 2020 21:13:49 -0800
Newsgroups gmane.comp.security.detection.bro
Message-ID <[email protected]>
VGhhbmtzIEpvaGFubmEgLSBJIG11c3Qgc2F5IHF1aXRlIHRpbWVseSBwYWNrYWdlLiAKCk9uIFR1
ZSwgSmFuIDE0LCAyMDIwIGF0IDA2OjQyOjE5UE0gLTA4MDAsIEpvaGFubmEgQW1hbm4gd3JvdGU6
Cj4gSGksCj4gCj4gSSBhc3N1bWUgbW9zdCBvZiB5b3UgaGVhcmQgb2YgQ1ZFLTIwMjAtMDYwMS4g
SWYgbm90IC0gc2VlIHRoZSBhZHZpc29yeSAKPiBhdCAKPiBodHRwczovL3BvcnRhbC5tc3JjLm1p
Y3Jvc29mdC5jb20vZW4tVVMvc2VjdXJpdHktZ3VpZGFuY2UvYWR2aXNvcnkvQ1ZFLTIwMjAtMDYw
MSAKPiBhbmQgdGhlIGRlc2NyaXB0aW8gbmF0IAo+IGh0dHBzOi8vbWVkaWEuZGVmZW5zZS5nb3Yv
MjAyMC9KYW4vMTQvMjAwMjIzNDI3NS8tMS8tMS8wL0NTQS1XSU5ET1dTLTEwLUNSWVBULUxJQi0y
MDE5MDExNC5QREYuCj4gCj4gSSBoYXZlIGEgc21hbGwgd29yay1pbi1wcm9ncmVzcyBaZWVrIHBh
Y2thZ2UgdGhhdCBzaG91bGQgYmUgYWJsZSB0byAKPiBkZXRlY3QgaWYgc29tZW9uZSBpcyB0cnlp
bmcgdG8gZXhwbG9pdCB0aGlzIGluIFRMUyBjb21tdW5pY2F0aW9uLCBlLmcuIAo+IHdoZW4gaW1w
ZXJzb25hdGluZyBhIHNlcnZlci4KPiAKPiBUaGUgcGFja2FnZSBpcyBhdmFpbGFibGUgYXQgaHR0
cHM6Ly9naXRodWIuY29tLzB4eG9uL2N2ZS0yMDIwLTA2MDE7IHRoZSAKPiBzY3JpcHQgaXRzZWxm
IGlzIHZlcnkgc2hvcnQgYW5kIGF2YWlsYWJsZSBhdCAKPiBodHRwczovL2dpdGh1Yi5jb20vMHh4
b24vY3ZlLTIwMjAtMDYwMS9ibG9iL21hc3Rlci9zY3JpcHRzL2N2ZS0yMDIwLTA2MDEuYnJvLgo+
IAo+IEhvdyBkb2VzIGl0IHdvcmsKPiA9PT09PT09PT09PT09PT09Cj4gCj4gIEZyb20gdGhlIGRl
c2NyaXB0aW9uIGFib3ZlLCB0aGUgYXR0YWNrIHNlZW1zIHRvIHJlcXVpcmUgY3VydmVzIHRoYXQg
YXJlIAo+IGV4cGxpY2l0bHktZGVmaW5lZCB0byBiZSBwcmVzZW50IGluIGNlcnRpZmljYXRlczsg
ZnVydGhlcm1vcmUgdGhlIGN1cnZlIAo+IG5lZWRzIHRvIGJlIGEgbm9uLXN0YW5kYXJkIGN1cnZl
LiBIYXZpbmcgYW4gZXhwbGljaXRseSBkZWZpbmVkIGN1cnZlIGluIAo+IGEgY2VydGlmaWNhdGUg
aXMgcXVpdGUgdW51c3VhbCAtIFJGQyA1NDgwIGFjdHVhbGx5IGZvcmJpZHMgdGhpcyAKPiBzcGVj
aWZpY2FsbHkuCj4gCj4gVGhlIHNjcmlwdCBsaW5rZWQgYWJvdmUgY2hlY2tzIGlmIGEgY2VydGlm
aWNhdGUgaXMgYW4gZWxsaXB0aWMgY3VydmUgCj4gY2VydGlmaWNhdGUgLSBhbmQgdGhlbiBjaGVj
a3MgaWYgdGhlIGN1cnZlIGZpZWxkIHdhcyBzZXQgYnkgWmVlayAtIHdoaWNoIAo+IGl0IHNob3Vs
ZCBhbHdheXMgYmUgZm9yIG5hbWVkIGN1cnZlcy4gSWYgdGhlIGN1cnZlIGlzIG5vdCBzZXQsIGEg
bm90aWNlIAo+IGlzIHJhaXNlZC4KPiAKPiBMaW1pdGF0aW9ucyAmIEZhbHNlIHBvc2l0aXZlcwo+
ID09PT09PT09PT09PT09PT09PT09PT09PT09PT09Cj4gCj4gU2hvcnQgdmVyc2lvbjogdGhlcmUg
bWF5IGJlIGZhbHNlIHBvc2l0aXZlcyAtIGl0IHNob3VsZCBub3QgYmUgbWFueS4KPiAKPiBJZiBJ
IHVuZGVyc3RhbmQgQ1ZFLTIwMjAtMDYwMSBjb3JyZWN0bHksIHRoaXMgc2NyaXB0IHNob3VsZCBh
bHdheXMgYWxlcnQgCj4gd2hlbiBhIHN1c3BpY2lvdXMgY2VydGlmaWNhdGUgaXMgZm91bmQgaW4g
dHJhZmZpYy4gSG93ZXZlciwgdGhlcmUgYXJlIGEgCj4gZmV3IGNhc2VzIHdoZXJlIGl0IG1heSBh
bGVydCB3aGVuIGEgY2VydGlmaWNhdGUgaXMgYmVuaWduLgo+IAo+IFNwZWNpZmljYWxseSwgaXQg
aXMgcG9zc2libGUgZm9yIGEgY2VydGlmaWNhdGUgdG8gZXhwbGljaXRseSBkZWZpbmUgYSAKPiB3
ZWxsLWtub3duIGN1cnZlLCBpbnN0ZWFkIG9mIGp1c3QgcHV0dGluZyB0aGUgSUQgb2YgdGhlIGN1
cnZlIGluIHRoZSAKPiBjZXJ0aWZpY2F0ZS4gV2hlbiB0aGlzIGhhcHBlbnMsIHRoZSBhbGVydCBi
ZWhhdmlvciBvZiB0aGUgc2NyaXB0IAo+IGN1cnJlbnRseSBkZXBlbmRzIG9uIHRoZSBsb2NhbGx5
IGluc3RhbGxlZCB2ZXJzaW9uIG9mIE9wZW5TU0wuIFNvbWUgCj4gdmVyc2lvbnMgb2YgT3BlblNT
TCBjb252ZXJ0IHRoZSBjdXJ2ZSBiYWNrIHRvIGl0cyBuYW1lIC0gaW4gd2hpY2ggY2FzZSAKPiBu
byBhbGVydCBpcyByYWlzZWQgKHdoaWNoIGlzIGNvcnJlY3QpLiBIb3dldmVyLCBvdGhlciB2ZXJz
aW9ucyBkbyBub3QgZG8gCj4gdGhpcyAtIGFuZCBsZWFkIHRvIFplZWsgbGVhdmluZyB0aGUgZmll
bGQgZW1wdHkuIFRoaXMgd2lsbCBsZWFkIHRvIGEgCj4gbm90aWNlIGJlaW5nIHJhaXNlZC4KPiAK
PiBJIGFtIG5vdCBzdXJlIHdoeSB0aGUgYmVoYXZpb3IgZGlmZmVycyAtIHRoaXMgc2VlbXMgdG8g
ZGVwZW5kIG9uIAo+IGNvbmZpZ3VyYXRpb24gY2hvaWNlcyBvZiBkaWZmZXJlbnQgTGludXggZGlz
dHJpYnV0aW9ucyAtIGFuZCBzYWRseSB0aGlzIAo+IHNlZW1zIHRvIG5vdCB3b3JrIGluIGEgbG90
IG9mIGxpbnV4IGRpc3RyaWJ1dGlvbnMuIEkgY291bGQgbm90IG1hcCBpdCB0byAKPiBzcGVjaWZp
YyB2ZXJzaW9ucyBvZiBPcGVuU1NMLgo+IAo+IFRoZSBwYWNrYWdlIGNvbnRhaW5zIHNldmVyYWwg
dGVzdHMgLSBpZiB0aGUgZXhwbGljaXQuYnJvIHRlc3QgZmFpbHMsIAo+IHlvdXIgT3BlblNTTCBp
bnN0YWxsYXRpb24gZG9lcyBub3QgcGVyZm9ybSB0aGUgY29udmVyc2lvbiAtIHdoaWNoIAo+IHRo
ZW9yZXRpY2FsbHkgbGVhZCB0byBmYWxzZSBwb3NpdGl2ZXMuCj4gCj4gVGhhdCBiZWluZyBzYWlk
IC0gaW4gdGhlb3J5LCBleHBsaWNpdCBjdXJ2ZXMgc2hvdWxkIG5vdCBiZSB1c2VkIGZvciBUTFMg
Cj4gY29tbXVuaWNhdGlvbi4gV2hpY2ggYnJpbmdzIG1lIHRv4oCmCj4gCj4gRmVlZGJhY2sKPiA9
PT09PT09PQo+IAo+IElmIHlvdSB1c2UgdGhpcyBhbmQgc2VlIGl0IHJhaXNpbmcgYSBsb3Qgb2Yg
bm90aWNlcywgb3IgaGF2ZSBvdGhlciAKPiBmZWVkYmFjayAtIHBsZWFzZSB3cml0ZSBlaXRoZXIg
aGVyZSBvciB0byBtZSBkaXJlY3RseS4KPiAKPiBJIGFtIGN1cnJlbnRseSB3b3JraW5nIG9uIHRy
eWluZyB0byBnZXQgdGhlIGRldGVjdGlvbiBiZXR0ZXIgLSB0aGlzIHdpbGwgCj4gcmVxdWlyZSBt
YWtpbmcgdGhpcyBhIGJpbmFyeSBtb2R1bGUgdGhhdCBkaXJlY3RseSBjYWxscyBpbnRvIE9wZW5T
U0wgdG8gCj4gZXhhbWluZSB0aGUgY2VydGlmaWNhdGUgZGF0YXN0cnVjdHVyZXMuCj4gCj4gSm9o
YW5uYQo+IAo+IF9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
Cj4gWmVlayBtYWlsaW5nIGxpc3QKPiB6ZWVrQHplZWsub3JnCj4gaHR0cDovL21haWxtYW4uSUNT
SS5CZXJrZWxleS5FRFUvbWFpbG1hbi9saXN0aW5mby96ZWVrCl9fX19fX19fX19fX19fX19fX19f
X19fX19fX19fX19fX19fX19fX19fX19fX19fClplZWsgbWFpbGluZyBsaXN0CnplZWtAemVlay5v
cmcKaHR0cDovL21haWxtYW4uSUNTSS5CZXJrZWxleS5FRFUvbWFpbG1hbi9saXN0aW5mby96ZWVr