GHSA-hq2w-pg4m-6w63: Ettercap through 0.8.4.1 Out-of-Bounds Read via sslw_remove_sts
Ettercap through 0.8.4.1 contains an out-of-bounds read and sizet underflow vulnerability in sslwremovests() in src/ecsslwrap.c, caused by a stale length and an unchecked memmem() result when stripping Strict-Transport-Security headers. A malicious HTTPS server whose response passes through Ettercap's SSL interception can trigger out-of-bounds reads and memory corruption in the Ettercap process, which normally runs as root.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of Ettercap through 0.8.4.1 are exposed when they perform SSL interception and process HTTPS responses from malicious servers. The affected Ettercap process normally runs as root, increasing the impact of a successful trigger.
What does an attacker need to exploit it?
An attacker needs to operate or control a malicious HTTPS server and have its response pass through Ettercap's SSL interception. No privileges or user interaction are required according to the supplied vector.
Are systems that do not use SSL interception affected?
The described trigger is in the SSL header-stripping path and requires a malicious HTTPS response to pass through Ettercap's SSL interception. The provided information does not establish exposure for deployments that do not use that functionality.