CVE-2016-1417

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Untrusted search path vulnerability in Snort 2.9.7.0-WIN32 allows remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse tcapi.dll that is located in the same folder on a remote file share as a pcap file that is being processed.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-426

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://hyp3rlinx.altervista.org/advisories/SNORT-DLL-HIJACK.txtExploit, Third Party Advisory
http://packetstormsecurity.com/files/138915/Snort-2.9.7.0-WIN32-DLL-Hijacking.htmlExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/539579/100/0/threaded
http://www.securityfocus.com/bid/93269Exploit, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036936Exploit, Third Party Advisory, VDB Entry
http://hyp3rlinx.altervista.org/advisories/SNORT-DLL-HIJACK.txtExploit, Third Party Advisory
http://packetstormsecurity.com/files/138915/Snort-2.9.7.0-WIN32-DLL-Hijacking.htmlExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/539579/100/0/threaded
http://www.securityfocus.com/bid/93269Exploit, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036936Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Jan 23, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-14187.8Cisco Aironet Access Point Software 8.2(100.0) on 1830e, 1830i, 1850e, 1850i, 2800, and 3800 access points allows local users to obtain Linu CVE-2016-14198.1Cisco Access Point devices with software 8.2(102.43) allow remote attackers to cause a denial of service (device reload) via crafted ARP pac CVE-2016-14207.8The installation component on Cisco Application Policy Infrastructure Controller (APIC) devices with software before 1.3(2f) mishandles bina CVE-2016-14217.5A vulnerability in the web application for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privile CVE-2016-14236.1A vulnerability in the display of email messages in the Messages in Quarantine (MIQ) view in Cisco AsyncOS for Cisco Email Security Applianc CVE-2016-14246.5Cisco IOS 15.2(1)T1.11 and 15.2(2)TST allows remote attackers to cause a denial of service (device crash) via a crafted LLDP packet, aka Bug CVE-2016-14256.5Cisco IOS 15.0(2)SG5, 15.1(2)SG3, 15.2(1)E, 15.3(3)S, and 15.4(1.13)S allows remote attackers to cause a denial of service (device crash) vi CVE-2016-14267.5Cisco IOS XR 5.x through 5.2.5 on NCS 6000 devices allows remote attackers to cause a denial of service (timer consumption and Route Process CVE-2016-14277.5The System Configuration Protocol (SCP) core messaging interface in Cisco Prime Network Registrar 8.2 before 8.2.3.1 and 8.3 before 8.3.2 al CVE-2016-14286.5Double free vulnerability in Cisco IOS XE 3.15S, 3.16S, and 3.17S allows remote authenticated users to cause a denial of service (device res CVE-2016-14297.5Directory traversal vulnerability in the web interface on Cisco RV180 and RV180W devices allows remote attackers to read arbitrary files via CVE-2016-14308.8Cisco RV180 and RV180W devices allow remote authenticated users to execute arbitrary commands as root via a crafted HTTP request, aka Bug ID