Bug 894092 (CVE-2013-0722)

Summary:	CVE-2013-0722 ettercap: stack-based buffer overflow when parsing hosts list
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	ago, costamagnagianfranco, gwync
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	ettercap 0.7.5.2	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-02-05 21:51:56 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	894094, 894096
Bug Blocks:

Description Vincent Danen 2013-01-10 16:55:23 UTC

A stack-based buffer overflow was reported [1],[2] in Ettercap <= 0.7.5.1.  A boundary error within the scan_load_hosts() function (in src/ec_scan.c), when parsing entries from a hosts list, could be exploited to cause a stack-based buffer overflow via an overly long entry.  In order to exploit this, a user must be tricked into loading a malicious host file.

This has not yet been corrected upstream, but a proposed patch is available [3].

The initial report [1] indicates that this was given the name CVE-2012-0722.

[1] http://www.exploit-db.com/exploits/23945/
[2] https://secunia.com/advisories/51731/
[3] http://www.securation.com/files/2013/01/ec.patch

Comment 1 Vincent Danen 2013-01-10 16:58:33 UTC

Created ettercap tracking bugs for this issue

Affects: fedora-all [bug 894094]
Affects: epel-all [bug 894096]

Comment 2 Vincent Danen 2013-01-11 21:57:44 UTC

This was meant to be CVE-2013-0722, not a 2012 CVE.

Comment 3 Gianfranco 2013-01-23 22:00:53 UTC

This has been fixed upstream, you can cherry pick the patch or wait for the next tag.

The new version will bring up many bug fix including this one

Comment 4 Agostino Sarubbo 2013-01-29 12:29:28 UTC

0.7.5.2 fixes this issue.

Comment 5 Gwyn Ciesla 2013-01-29 14:22:05 UTC

When is it going to be released?

Comment 6 Agostino Sarubbo 2013-01-29 14:29:32 UTC

(In reply to comment #5)
> When is it going to be released?

https://github.com/Ettercap/ettercap/archive/v0.7.5.2.tar.gz

Comment 7 Gwyn Ciesla 2013-01-29 14:46:29 UTC

Ah, I see.  It's not on the website. :)

Comment 8 Gianfranco 2013-01-30 07:55:34 UTC

Please don't update to 0.7.5.2 unless you patch include/ec_version.h file!

Is still in the old version, I think we will release 0.7.5.3 soon

Comment 9 Gwyn Ciesla 2013-01-30 14:07:24 UTC

Ok, my build failed for some reason anyway, please let me know as soon as 0.7.5.3 is out.

Comment 10 Agostino Sarubbo 2013-01-30 15:39:45 UTC

(In reply to comment #9)
> Ok, my build failed for some reason anyway, please let me know as soon as
> 0.7.5.3 is out.

It doesn't fail here(on gentoo), what's your problem?

Comment 11 Gwyn Ciesla 2013-01-30 16:17:50 UTC

I was fine locally and in mock, but failed in koji in rawhide.  Investigating.  Might have been temporary rawhide brokenness.

Comment 12 Gwyn Ciesla 2013-01-30 16:52:48 UTC

I wasn't requiring groff for the build, I fixed it, it's fine now.

Comment 13 Gianfranco 2013-01-30 22:01:00 UTC

The problem for 0.7.5.2 is only cosmetic, ec_include.h defines the version as 0.7.5.1, so just the menu title is not updated, not a really bug :))
wich kind of error do you receive?

Comment 14 Gwyn Ciesla 2013-02-01 14:43:15 UTC

Nothing, when groff is present.

Comment 15 Gianfranco 2013-02-01 15:30:56 UTC

I don't know what groff means... :-) BTW ettercap 0.7.5.3 is out, just two minor.fix about versioning and a fedora bug fixed upstream.

Comment 16 Gwyn Ciesla 2013-02-01 15:31:55 UTC

Excellent, thanks!

Comment 17 Vincent Danen 2013-02-05 21:51:56 UTC

This has been fixed now via:

ettercap-0.7.5-3.fc16.1.20120906gitc796e5
ettercap-0.7.5-4.fc17.1.20120906gitc796e5
ettercap-0.7.5.1-1.fc18

and:

ettercap-0.7.3-21.el5
ettercap-0.7.5-3.el6.1.20120906gitc796e5