Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 5133] Wireshark vulnerable to DLL hijacking

[bugzilla-daemon@xxxxxxxxxxxxx]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5133

--- Comment #8 from Gerald Combs <gerald@xxxxxxxxxxxxx> 2010-08-26 17:20:42 PDT ---
With the LoadLibrary and g_module_open calls in place and the calls to
SetDllDirectory commented out we end up with the following load attempts on
Windows 7:

wireshark.exe    C:\path\to\Captures\packet.dll
wireshark.exe    C:\path\to\Captures\iphlpapi.dll
wireshark.exe    C:\path\to\Captures\WINNSI.DLL
wireshark.exe    C:\path\to\Captures\drivers\NPF.sys
wireshark.exe    C:\path\to\Captures\libintl-8.dll
wireshark.exe    C:\path\to\Captures\CRYPTSP.dll
wireshark.exe    C:\path\to\Captures\NETAPI32.DLL
wireshark.exe    C:\path\to\Captures\netutils.dll
wireshark.exe    C:\path\to\Captures\srvcli.dll
wireshark.exe    C:\path\to\Captures\wkscli.dll
wireshark.exe    C:\path\to\Captures\dhcpcsvc6.DLL
wireshark.exe    C:\path\to\Captures\dhcpcsvc.DLL
dumpcap.exe    C:\path\to\Captures\USERENV.dll
dumpcap.exe    C:\path\to\Captures\profapi.dll
dumpcap.exe    C:\path\to\Captures\MPR.dll
dumpcap.exe    C:\path\to\Captures\UxTheme.dll
dumpcap.exe    C:\path\to\Captures\WINMM.dll
dumpcap.exe    C:\path\to\Captures\samcli.dll
dumpcap.exe    C:\path\to\Captures\MSACM32.dll
dumpcap.exe    C:\path\to\Captures\VERSION.dll
dumpcap.exe    C:\path\to\Captures\sfc.dll
dumpcap.exe    C:\path\to\Captures\sfc_os.DLL
dumpcap.exe    C:\path\to\Captures\dwmapi.dll
dumpcap.exe    C:\path\to\Captures\SHUNIMPL.DLL
dumpcap.exe    C:\path\to\Captures\packet.dll
dumpcap.exe    C:\path\to\Captures\iphlpapi.dll
dumpcap.exe    C:\path\to\Captures\WINNSI.DLL
dumpcap.exe    C:\path\to\Captures\drivers\NPF.sys
dumpcap.exe    C:\path\to\Captures\dhcpcsvc6.DLL
dumpcap.exe    C:\path\to\Captures\dhcpcsvc.DLL
wireshark.exe    C:\path\to\Captures\ntmarta.dll

Presumably users on XP (no service pack) and 2000 are vulnerable no matter
what.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.