Dan Rosenberg reported [1] the following vulnerability in Ettercap-GTK:

The GTK version of ettercap uses a global settings file at /tmp/.ettercapgtk and does not verify ownership of this file. When parsing this file for settings in gtkuiconfread() (src/interfaces/gtk/ecgtkconf.c), an unchecked sscanf() call allows a maliciously placed settings file to overflow a statically-sized buffer on the stack. Stack-smashing protection catches it, but it still should be fixed.

Verify with: $ perl -e 'print "A"x500' > /tmp/.ettercapgtk && ettercap -G

Firstly, the settings file should not be globally accessible without checking ownership, which still gets hairy because an attacker could create a symlink or hard link to a victim-controlled file (unless you're using YAMA :p). The best thing would probably be to keep this file in the user's home directory instead.

Secondly, parsing configuration files should be robust against malformed input and not susceptible to trivial buffer overflows.

This issue has been assigned the name CVE-2010-3843 [2].

[1] https://bugs.launchpad.net/ubuntu/+source/ettercap/+bug/656347 [2] http://article.gmane.org/gmane.comp.security.oss.general/3660

A stack-based buffer overflow was reported [1],[2] in Ettercap <= 0.7.5.1. A boundary error within the scanloadhosts() function (in src/ecscan.c), when parsing entries from a hosts list, could be exploited to cause a stack-based buffer overflow via an overly long entry. In order to exploit this, a user must be tricked into loading a malicious host file.

This has not yet been corrected upstream, but a proposed patch is available [3].

The initial report [1] indicates that this was given the name CVE-2012-0722.

[1] http://www.exploit-db.com/exploits/23945/ [2] https://secunia.com/advisories/51731/ [3] http://www.securation.com/files/2013/01/ec.patch