GHSA-jw9q-j2rm-94j2: Ettercap through 0.8.4.1 Out-of-Bounds Read via HTTP NTLM Authentication Parsing
Ettercap through 0.8.4.1 contains an out-of-bounds read vulnerability in ParseNTLMAuth() in src/dissectors/echttp.c due to unvalidated NTLM message offsets. Attackers can send a crafted HTTP Authorization header observed by Ettercap to read beyond the buffer, disclosing memory or crashing the process.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments running Ettercap through 0.8.4.1 are affected when Ettercap observes HTTP traffic containing NTLM authentication data. The vulnerable parsing function is in the HTTP dissector.
What must an attacker do to trigger the vulnerability?
An attacker must cause Ettercap to observe an HTTP Authorization header containing a crafted NTLM authentication message with unvalidated offsets. No privileges or user interaction are indicated by the provided severity vector.
What is the likely impact of successful exploitation?
A crafted message can make Ettercap read beyond the relevant buffer. This may disclose process memory or crash the Ettercap process.