CVE-2011-3360 — AI Deep Analysis Summary

🚨 **Essence**: Untrusted search path vulnerability in Wireshark. 📉 **Consequences**: Local users can execute malicious Lua scripts to gain **privileged access**.…

🛡️ **Root Cause**: The application relies on an **untrusted search path** for Lua scripts.…

📦 **Affected Versions**: 1. Wireshark **1.4.x** (before 1.4.9) 2. Wireshark **1.6.x** (before 1.6.2). ⚠️ Note: Wireshark was formerly known as **Ethereal**.

💀 **Attacker Action**: A local user places a **Trojan Lua script** in an unmonitored directory. 🔓 **Result**: When Wireshark runs, it executes this script with **elevated privileges**. Data integrity is compromised.

🔑 **Threshold**: **Low**. Requires **Local User** access. No remote exploitation or complex authentication bypass needed. Just physical/logical access to the local machine.

🌐 **Public Exploit**: **No** public PoC or wild exploit found in the provided data. 📝 **References**: Only vendor advisories (RedHat, Mandriva) and mailing list discussions (oss-security) are listed.

🔍 **Self-Check**: 1. Check your Wireshark version. 2. Is it **< 1.4.9** or **< 1.6.2**? 3. Inspect Lua script directories for unauthorized files. 4. Use vulnerability scanners targeting Wireshark CVE-2011-3360.

✅ **Fixed**: **Yes**. Official patches are available. 🔧 **Mitigation**: Upgrade to **Wireshark 1.4.9+** or **1.6.2+**. Vendor advisories from RedHat and Mandriva confirm the fix.

🚧 **No Patch Workaround**: 1. **Restrict permissions** on Lua script directories. 2. **Disable Lua scripting** if not needed. 3. Ensure only **trusted sources** are in the search path. 4.…

⚡ **Priority**: **Medium-High**. 📅 **Published**: 2011-09-20. 💡 **Insight**: While old, it highlights critical **local privilege escalation** risks.…