Re: [Wireshark-dev] External processes in Snort dissector - code execution

2017-08-29 Thread Peter Wu
On Tue, Aug 29, 2017 at 10:13:04AM +0200, Jakub Zawadzki wrote: > Hi Peter, > > W dniu 2017-08-28 18:50, Peter Wu napisał(a): > > This can especially problematic for services like Cloudshark and > > Webshark (by Jakub). The former is not yet affected since it does not > > use 2.4 code (yet?) but

Re: [Wireshark-dev] External processes in Snort dissector - code execution

2017-08-29 Thread Jakub Zawadzki
Hi Peter, W dniu 2017-08-28 18:50, Peter Wu napisał(a): This can especially problematic for services like Cloudshark and Webshark (by Jakub). The former is not yet affected since it does not use 2.4 code (yet?) but the latter seems theoretically vulnerable as it has a setconf API function (I

Re: [Wireshark-dev] External processes in Snort dissector - code execution

2017-08-28 Thread Martin Mathieson via Wireshark-dev
Hi Peter, I had not really thought about someone doing this. I have at times had multiple versions of snort installed in the same VM and used the option to switch between them... Its not a solution really, but I had thought I ought to run the snort binary with -V and check that it got a

[Wireshark-dev] External processes in Snort dissector - code execution

2017-08-28 Thread Peter Wu
Hi Martin and others, I have noticed that the snort dissector (added in Wireshark 2.4) can be configured to execute external processes, is this desirable? When a new pcap is loaded (or when a live capture starts), it will execute the following init routine: static void snort_start(void)