Would this vulnerability enable a malicious user to attack the administrator the moment he began monitoring the network?
No. It’s important to understand that the vulnerability lies in the parsers, not in Netmon itself. Parsers can only be used to interpret data that has been “delay captured” – that is, captured for later analysis. The parsers cannot be used to interpret data in real time. As a result, if an administrator was using Netmon for tasks other than data capture and analysis, the vulnerability would pose no threat.
Related Questions
- If the vulnerability were exploited to cause the malicious users code to run on the administrators machine, what could it do?
- Doesn the vulnerability require the user to click on the file: URL or UNC string in the malicious web page?
- Would the malicious user be able to tell when the administrator was using Netmon?
