{"uuid": "ea6ee153-f2b8-42c3-8961-777678c8e339", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2010-0304", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/wireshark_lwres_getaddrbyname.rb", "content": "{\"aliases\": [], \"arch\": \"x86, x64\", \"author\": [\"babi\", \"jduck \", \"redsand\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"The LWRES dissector in Wireshark version 0.9.15 through 1.0.10 and 1.2.0 through\\n          1.2.5 allows remote attackers to execute arbitrary code due to a stack-based buffer\\n          overflow. This bug found and reported by babi.\\n\\n          This particular exploit targets the dissect_getaddrsbyname_request function. Several\\n          other functions also contain potentially exploitable stack-based buffer overflows.\\n\\n          The Windows version (of 1.2.5 at least) is compiled with /GS, which prevents\\n          exploitation via the return address on the stack. Sending a larger string allows\\n          exploitation using the SEH bypass method. However, this packet will usually get\\n          fragmented, which may cause additional complications.\\n\\n          NOTE: The vulnerable code is reached only when the packet dissection is rendered.\\n          If the packet is fragmented, all fragments must be captured and reassembled to\\n          exploit this issue.\", \"disclosure_date\": \"2010-01-27\", \"fullname\": \"exploit/multi/misc/wireshark_lwres_getaddrbyname\", \"is_install_path\": true, \"mod_time\": \"2025-12-17 17:11:13 +0000\", \"name\": \"Wireshark LWRES Dissector getaddrsbyname_request Buffer Overflow\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/multi/misc/wireshark_lwres_getaddrbyname.rb\", \"platform\": \"Linux,OSX,Windows\", \"post_auth\": false, \"rank\": 500, \"ref_name\": \"multi/misc/wireshark_lwres_getaddrbyname\", \"references\": [\"CVE-2010-0304\", \"OSVDB-61987\", \"BID-37985\", \"URL-http://www.wireshark.org/security/wnpa-sec-2010-02.html\", \"URL-http://anonsvn.wireshark.org/viewvc/trunk-1.2/epan/dissectors/packet-lwres.c?view=diff&r1=31596&r2=28492&diff_format=h\"], \"rport\": 921, \"session_types\": false, \"targets\": [\"Automatic\", \"tshark 1.0.2-3+lenny7 on Debian 5.0.3 (x86)\", \"wireshark 1.0.2-3+lenny7 on Debian 5.0.3 (x86)\", \"wireshark 1.2.5 on RHEL 5.4 (x64)\", \"wireshark 1.2.5 on Mac OS X 10.5 (x86)\", \"wireshark/tshark 1.2.1 and 1.2.5 on Windows (x86)\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:50:27.535451Z"}