GHSA-vrjv-f8gv-2h35: Ettercap through 0.8.4.1 Heap Buffer Overflow via Gadu-Gadu Dissector
Ettercap through 0.8.4.1 contains a heap buffer overflow vulnerability in gggetversion() in src/dissectors/ecgg.c that writes up to 44 bytes into a 30-byte allocation. Remote attackers can send Gadu-Gadu traffic on TCP port 8074 with a crafted version field through a monitored network to corrupt heap memory in the Ettercap process, which normally runs as root.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments that monitor network traffic containing Gadu-Gadu traffic on TCP port 8074 are exposed. The vulnerable dissector is present in Ettercap through version 0.8.4.1.
What must an attacker be able to do to exploit it?
An attacker must be able to send Gadu-Gadu traffic with a crafted version field over TCP port 8074 through a network being monitored by Ettercap. No authentication or user interaction is indicated.
What is the likely impact if exploitation succeeds?
The crafted version field can corrupt heap memory in the Ettercap process. Because that process normally runs as root, successful exploitation may affect a privileged process.