Bug 894092 (CVE-2013-0722) - CVE-2013-0722 ettercap: stack-based buffer overflow when parsing hosts list
Summary: CVE-2013-0722 ettercap: stack-based buffer overflow when parsing hosts list
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: CVE-2013-0722
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 894094 894096
Blocks:
TreeView+ depends on / blocked
 
Reported: 2013-01-10 16:55 UTC by Vincent Danen
Modified: 2019-09-29 12:58 UTC (History)
3 users (show)

Fixed In Version: ettercap 0.7.5.2
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-02-05 21:51:56 UTC


Attachments (Terms of Use)

Description Vincent Danen 2013-01-10 16:55:23 UTC
A stack-based buffer overflow was reported [1],[2] in Ettercap <= 0.7.5.1.  A boundary error within the scan_load_hosts() function (in src/ec_scan.c), when parsing entries from a hosts list, could be exploited to cause a stack-based buffer overflow via an overly long entry.  In order to exploit this, a user must be tricked into loading a malicious host file.

This has not yet been corrected upstream, but a proposed patch is available [3].

The initial report [1] indicates that this was given the name CVE-2012-0722.

[1] http://www.exploit-db.com/exploits/23945/
[2] https://secunia.com/advisories/51731/
[3] http://www.securation.com/files/2013/01/ec.patch

Comment 1 Vincent Danen 2013-01-10 16:58:33 UTC
Created ettercap tracking bugs for this issue

Affects: fedora-all [bug 894094]
Affects: epel-all [bug 894096]

Comment 2 Vincent Danen 2013-01-11 21:57:44 UTC
This was meant to be CVE-2013-0722, not a 2012 CVE.

Comment 3 Gianfranco 2013-01-23 22:00:53 UTC
This has been fixed upstream, you can cherry pick the patch or wait for the next tag.

The new version will bring up many bug fix including this one

Comment 4 Agostino Sarubbo 2013-01-29 12:29:28 UTC
0.7.5.2 fixes this issue.

Comment 5 Gwyn Ciesla 2013-01-29 14:22:05 UTC
When is it going to be released?

Comment 6 Agostino Sarubbo 2013-01-29 14:29:32 UTC
(In reply to comment #5)
> When is it going to be released?

https://github.com/Ettercap/ettercap/archive/v0.7.5.2.tar.gz

Comment 7 Gwyn Ciesla 2013-01-29 14:46:29 UTC
Ah, I see.  It's not on the website. :)

Comment 8 Gianfranco 2013-01-30 07:55:34 UTC
Please don't update to 0.7.5.2 unless you patch include/ec_version.h file!

Is still in the old version, I think we will release 0.7.5.3 soon

Comment 9 Gwyn Ciesla 2013-01-30 14:07:24 UTC
Ok, my build failed for some reason anyway, please let me know as soon as 0.7.5.3 is out.

Comment 10 Agostino Sarubbo 2013-01-30 15:39:45 UTC
(In reply to comment #9)
> Ok, my build failed for some reason anyway, please let me know as soon as
> 0.7.5.3 is out.

It doesn't fail here(on gentoo), what's your problem?

Comment 11 Gwyn Ciesla 2013-01-30 16:17:50 UTC
I was fine locally and in mock, but failed in koji in rawhide.  Investigating.  Might have been temporary rawhide brokenness.

Comment 12 Gwyn Ciesla 2013-01-30 16:52:48 UTC
I wasn't requiring groff for the build, I fixed it, it's fine now.

Comment 13 Gianfranco 2013-01-30 22:01:00 UTC
The problem for 0.7.5.2 is only cosmetic, ec_include.h defines the version as 0.7.5.1, so just the menu title is not updated, not a really bug :))
wich kind of error do you receive?

Comment 14 Gwyn Ciesla 2013-02-01 14:43:15 UTC
Nothing, when groff is present.

Comment 15 Gianfranco 2013-02-01 15:30:56 UTC
I don't know what groff means... :-) BTW ettercap 0.7.5.3 is out, just two minor.fix about versioning and a fedora bug fixed upstream.

Comment 16 Gwyn Ciesla 2013-02-01 15:31:55 UTC
Excellent, thanks!

Comment 17 Vincent Danen 2013-02-05 21:51:56 UTC
This has been fixed now via:

ettercap-0.7.5-3.fc16.1.20120906gitc796e5
ettercap-0.7.5-4.fc17.1.20120906gitc796e5
ettercap-0.7.5.1-1.fc18

and:

ettercap-0.7.3-21.el5
ettercap-0.7.5-3.el6.1.20120906gitc796e5


Note You need to log in before you can comment on or make changes to this bug.