Описание
The GTK version of ettercap uses a global settings file at /tmp/.ettercap_gtk and does not verify ownership of this file. When parsing this file for settings in gtkui_conf_read() (src/interfacesgtk/ec_gtk_conf.c), an unchecked sscanf() call allows a maliciously placed settings file to overflow a statically-sized buffer on the stack.
| Релиз | Статус | Примечание |
|---|---|---|
| artful | ignored | end of life |
| bionic | not-affected | 1:0.8.0-11ubuntu0.3 |
| cosmic | not-affected | 1:0.8.0-11ubuntu0.3 |
| devel | not-affected | 1:0.8.0-11ubuntu0.3 |
| esm-apps/bionic | not-affected | 1:0.8.0-11ubuntu0.3 |
| esm-apps/xenial | not-affected | 1:0.8.0-11ubuntu0.3 |
| esm-infra-legacy/trusty | DNE | trusty/esm was DNE [trusty was not-affected [1:0.8.0-11ubuntu0.3]] |
| hardy | ignored | end of life |
| lucid | ignored | end of life |
| natty | ignored | end of life |
Показывать по
Ссылки на источники
EPSS
4.6 Medium
CVSS2
7.8 High
CVSS3
Связанные уязвимости
The GTK version of ettercap uses a global settings file at /tmp/.ettercap_gtk and does not verify ownership of this file. When parsing this file for settings in gtkui_conf_read() (src/interfacesgtk/ec_gtk_conf.c), an unchecked sscanf() call allows a maliciously placed settings file to overflow a statically-sized buffer on the stack.
The GTK version of ettercap uses a global settings file at /tmp/.etter ...
The gtkui_conf_read function in src/interfaces/gtk/ec_gtk_conf.c in Ettercap 0.7.3, when the GTK interface is used, does not ensure that the contents of the .ettercap_gtk file are controlled by the root user, which allows local users to conduct stack-based buffer overflow attacks and possibly execute arbitrary code, cause a denial of service (memory consumption), or possibly have unspecified other impact via crafted lines in this file.
Уязвимость функции gtkui_conf_read() компонента src/interfacesgtk/ec_gtk_conf.c инструмента защиты от MITM атак в LAN Ettercap, связанная с записью за границами буфера, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
EPSS
4.6 Medium
CVSS2
7.8 High
CVSS3