Dan Rosenberg reported [1] the following vulnerability in Ettercap-GTK: The GTK version of ettercap uses a global settings file at /tmp/.ettercap_gtk and does not verify ownership of this file. When parsing this file for settings in gtkui_conf_read() (src/interfaces/gtk/ec_gtk_conf.c), an unchecked sscanf() call allows a maliciously placed settings file to overflow a statically-sized buffer on the stack. Stack-smashing protection catches it, but it still should be fixed. Verify with: $ perl -e 'print "A"x500' > /tmp/.ettercap_gtk && ettercap -G Firstly, the settings file should not be globally accessible without checking ownership, which still gets hairy because an attacker could create a symlink or hard link to a victim-controlled file (unless you're using YAMA :p). The best thing would probably be to keep this file in the user's home directory instead. Secondly, parsing configuration files should be robust against malformed input and not susceptible to trivial buffer overflows. This issue has been assigned the name CVE-2010-3843 [2]. [1] https://bugs.launchpad.net/ubuntu/+source/ettercap/+bug/656347 [2] http://article.gmane.org/gmane.comp.security.oss.general/3660
Created ettercap tracking bugs for this issue Affects: fedora-all [bug 643454]
This also affects ettercap in EPEL4 and 5.
Created ettercap tracking bugs for this issue Affects: epel-4 [bug 709422] Affects: epel-5 [bug 709423]
this is fixed in 0.7.5
0.7.5 is currently in all supported releases of Fedora. This is fixed in EPEL6 via 0.7.4-2.el6 and EPEL5 via 0.7.3-20.el5 and was also patched in Fedora 16 via 0.7.4-3.fc16.
Just a note that the fix for this issue also resolves CVE-2010-3844, which was the "incorrect parsing of configuration files" from the original report.