GHSA-v48w-7cvh-c7f4: Ettercap through 0.8.4.1 Heap Out-of-Bounds Read via TLS SNI Parsing
Ettercap through 0.8.4.1 contains a heap out-of-bounds read vulnerability in sslwgetclienthellosni() in src/ecsslwrap.c that trusts the unchecked 16-bit SNI length field. Network-adjacent attackers can send crafted TLS ClientHello messages during SSL interception to leak up to 64 KB of heap memory upstream or crash Ettercap.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using Ettercap through 0.8.4.1 for SSL interception are exposed when they process TLS ClientHello messages. The vulnerable code is the SNI parsing path in sslw_get_clienthello_sni().
What does an attacker need to exploit this issue?
A network-adjacent attacker needs to send a crafted TLS ClientHello message while SSL interception is taking place. The provided data indicates no privileges or user interaction are required.
What is the practical impact of successful exploitation?
An attacker may leak up to 64 KB of Ettercap heap memory upstream or crash the Ettercap process. Integrity impact is listed as none, while confidentiality and availability impact are high.