DEBIAN-CVE-2026-125403: High severity debian/ettercap vulnerability
Ettercap through 0.8.4.1 contains an out-of-bounds read and sizet underflow vulnerability in sslwremovests() in src/ecsslwrap.c, caused by a stale length and an unchecked memmem() result when stripping Strict-Transport-Security headers. A malicious HTTPS server whose response passes through Ettercap's SSL interception can trigger out-of-bounds reads and memory corruption in the Ettercap process, which normally runs as root.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using Ettercap SSL interception are exposed when HTTPS responses pass through the affected process. The impact is especially significant because Ettercap normally runs as root.
What must an attacker do to exploit it?
An attacker needs to operate or control a malicious HTTPS server and cause its response to pass through Ettercap's SSL interception. No attacker privileges or user interaction are required according to the supplied severity vector.
Are all Ettercap deployments affected by default?
The issue is specifically triggered while stripping Strict-Transport-Security headers in Ettercap's SSL interception path. The provided data does not establish whether SSL interception is enabled by default.
What versions are affected?
Ettercap through version 0.8.4.1 is affected.