UBUNTU-CVE-2026-125405: High severity ubuntu/ettercap vulnerability
Ettercap through 0.8.4.1 contains an out-of-bounds read vulnerability in ParseNTLMAuth() in src/dissectors/echttp.c due to unvalidated NTLM message offsets. Attackers can send a crafted HTTP Authorization header observed by Ettercap to read beyond the buffer, disclosing memory or crashing the process.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Ubuntu systems running Ettercap through version 0.8.4.1 are affected when Ettercap observes HTTP traffic containing NTLM Authorization headers. The issue is in Ettercap's HTTP dissector.
What does an attacker need to exploit it?
An attacker needs to cause Ettercap to observe an HTTP request with a crafted NTLM Authorization header containing invalid message offsets. No attacker privileges or user interaction are required according to the supplied severity vector.
What is the impact of successful exploitation?
Successful exploitation can cause Ettercap to read beyond its intended buffer boundary, which may disclose process memory or crash the Ettercap process. The supplied severity vector indicates high confidentiality impact and high availability impact, with no integrity impact.