Untrusted search path vulnerability in Wireshark 0.8.4 through 1.0.15 and 1.2.0 through 1.2.10 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse airpcap.dll, and possibly other DLLs, that is located in the same folder as a file that automatically launches Wireshark.

The remote host is affected by the vulnerability described in GLSA-201110-02 (Wireshark: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Wireshark. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could send specially crafted packets on a network       being monitored by Wireshark, entice a user to open a malformed packet       trace file using Wireshark, or deploy a specially crafted Lua script for       use by Wireshark, possibly resulting in the execution of arbitrary code,       or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The installed version of Wireshark or Ethereal is 1.2.0 - 1.2.10 or 0.8.4 - 1.0.15.  Such versions are affected by the following vulnerability :

  - The application uses a fixed path to look for specific     files or libraries, such as for 'airpcap.dll', and this     path includes directories that may not be trusted or     under user control. If a malicious DLL with the same     name as a required DLL is located in the application's     current working directory, the malicious DLL will be     loaded. (Bug 5133)

ID	Name	Product	Family	Type	Severity
56426	GLSA-201110-02 : Wireshark: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	critical
48943	Wireshark / Ethereal < 1.2.11 / 1.0.16 Path Subversion Arbitrary DLL Injection Code Execution	Nessus	Windows	Local	high

Detections

Analytics

CVE-2010-3133

high

Tenable Plugins

critical

high