CVE-2010-3843 The GTK version of ettercap uses a global settings file at /tmp/.ettercap_gtk and does not verify ownership of this file. When parsing this file for settings in gtkui_conf_read() (src/interfacesgtk/ec...
HighCVSS 7.8
EPSS 0.31%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The GTK version of ettercap uses a global settings file at /tmp/.ettercap_gtk and does not verify ownership of this file. When parsing this file for settings in gtkui_conf_read() (src/interfacesgtk/ec_gtk_conf.c), an unchecked sscanf() call allows a maliciously placed settings file to overflow a statically-sized buffer on the stack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/ettercap(Debian:12) | < 1:0.7.4-1 | 1:0.7.4-1 |
| debian/ettercap(Debian:13) | < 1:0.7.4-1 | 1:0.7.4-1 |
| ettercap-project ettercap | = 0.7.3 | No fix listed |
References
- Debian Security Tracker CVE-2010-3843 vendor-advisory
- article.gmane.org
- bugs.launchpad.net patch third-party-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- bugs.debian.org issue-tracking