GHSA-w5ch-7c4x-crcc: Ettercap through 0.8.4.1 Stack Buffer Underwrite via Telnet Dissector Backspace Handling
Ettercap through 0.8.4.1 contains a stack buffer underwrite vulnerability in the telnet dissector in src/dissectors/ectelnet.c that decrements the output pointer on backspace without a lower bound check. Attackers can send a telnet stream with more backspaces than preceding characters to write below the stack buffer, corrupting the stack of the Ettercap process that normally runs as root.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Ettercap deployments through 0.8.4.1 are affected when they process Telnet traffic with the Telnet dissector. The impact is especially significant where the Ettercap process runs as root, because stack corruption occurs in that process.
What does an attacker need to exploit it?
An attacker needs to send a Telnet stream containing more backspace characters than preceding characters. No privileges or user interaction are required according to the supplied vector.
How can I determine whether my environment is affected?
Check whether you run Ettercap version 0.8.4.1 or earlier and whether it is inspecting Telnet traffic. Review the process privileges as well, since the description states that Ettercap normally runs as root.