A vulnerability has been found in Ettercap 0.8.4-Garofalo. Affected by this vulnerability is the function adddatasegment of the file src/ettercap/utils/etterfilter/efoutput.c of the component etterfilter. The manipulation leads to out-of-bounds read. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

An unchecked sscanf() call in ettercap before 0.7.5 allows an insecure temporary settings file to overflow a static-sized buffer on the stack.

The compiletree function in efcompiler.c in the Etterfilter utility in Ettercap 0.8.2 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted filter.

Integer signedness error in the dissectorcvs function in dissectors/eccvs.c in Ettercap 0.8.1 allows remote attackers to cause a denial of service (crash) via a crafted password, which triggers a large memory allocation.

Heap-based buffer overflow in the nbnsspoof function in plug-ins/nbnsspoof/nbnsspoof.c in Ettercap 0.8.1 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a large netbios packet.

The radiusgetattribute function in dissectors/ecradius.c in Ettercap 0.8.1 performs an incorrect cast, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, which triggers a stack-based buffer overflow.

Integer underflow in Ettercap 0.8.1 allows remote attackers to cause a denial of service (out-of-bounds write) and possibly execute arbitrary code via a small (1) size variable value in the dissectordhcp function in dissectors/ecdhcp.c, (2) length value to the dissectorgg function in dissectors/ecgg.c, or (3) string length to the getdecodelen function in ecutils.c or a request without a (4) username or (5) password to the dissectorTN3270 function in dissectors/ecTN3270.c.

Ettercap 0.8.1 does not validate certain return values, which allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted (1) name to the parseline function in mdnsspoof/mdnsspoof.c or (2) base64 encoded password to the dissectorimap function in dissectors/ecimap.c.

Heap-based buffer overflow in the dissectorpostgresql function in dissectors/ecpostgresql.c in Ettercap before 0.8.1 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted password length value that is inconsistent with the actual length of the password.

The dissectorcvs function in dissectors/eccvs.c in Ettercap 0.8.1 allows remote attackers to cause a denial of service (out-of-bounds read) via a packet containing only a CVSLOGIN signature.

The dissectorpostgresql function in dissectors/ecpostgresql.c in Ettercap before 0.8.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted password length, which triggers a 0 character to be written to an arbitrary memory location.

A stack-based buffer overflow was reported [1],[2] in Ettercap <= 0.7.5.1. A boundary error within the scanloadhosts() function (in src/ecscan.c), when parsing entries from a hosts list, could be exploited to cause a stack-based buffer overflow via an overly long entry. In order to exploit this, a user must be tricked into loading a malicious host file.

This has not yet been corrected upstream, but a proposed patch is available [3].

The initial report [1] indicates that this was given the name CVE-2012-0722.

[1] http://www.exploit-db.com/exploits/23945/ [2] https://secunia.com/advisories/51731/ [3] http://www.securation.com/files/2013/01/ec.patch

Dan Rosenberg reported [1] the following vulnerability in Ettercap-GTK:

The GTK version of ettercap uses a global settings file at /tmp/.ettercapgtk and does not verify ownership of this file. When parsing this file for settings in gtkuiconfread() (src/interfaces/gtk/ecgtkconf.c), an unchecked sscanf() call allows a maliciously placed settings file to overflow a statically-sized buffer on the stack. Stack-smashing protection catches it, but it still should be fixed.

Verify with: $ perl -e 'print "A"x500' > /tmp/.ettercapgtk && ettercap -G

Firstly, the settings file should not be globally accessible without checking ownership, which still gets hairy because an attacker could create a symlink or hard link to a victim-controlled file (unless you're using YAMA :p). The best thing would probably be to keep this file in the user's home directory instead.

Secondly, parsing configuration files should be robust against malformed input and not susceptible to trivial buffer overflows.

This issue has been assigned the name CVE-2010-3843 [2].

[1] https://bugs.launchpad.net/ubuntu/+source/ettercap/+bug/656347 [2] http://article.gmane.org/gmane.comp.security.oss.general/3660