BID:13820

Ettercap Remote Format String Vulnerability

Info

Ettercap Remote Format String Vulnerability

Bugtraq ID:	13820
Class:	Input Validation Error
CVE:	CVE-2005-1796
Remote:	Yes
Local:	No
Published:	May 31 2005 12:00AM
Updated:	Jul 12 2009 02:56PM
Credit:	The vendor reported this issue.
Vulnerable:	Ettercap Ettercap NG 0.7.2 Ettercap Ettercap NG 0.7.1 + Debian Linux 3.1 sparc + Debian Linux 3.1 s/390 + Debian Linux 3.1 ppc + Debian Linux 3.1 mipsel + Debian Linux 3.1 mips + Debian Linux 3.1 m68k + Debian Linux 3.1 ia-64 + Debian Linux 3.1 ia-32 + Debian Linux 3.1 hppa + Debian Linux 3.1 arm + Debian Linux 3.1 amd64 + Debian Linux 3.1 alpha + Debian Linux 3.1 Ettercap Ettercap NG 0.7 .0 Ettercap Ettercap 0.6.9 Ettercap Ettercap 0.6.7 Ettercap Ettercap 0.6.6 .6 Ettercap Ettercap 0.6.5 Ettercap Ettercap 0.6.4 Ettercap Ettercap 0.6.3 .1 Ettercap Ettercap 0.6 .b Ettercap Ettercap 0.6 .a

Not Vulnerable:	Ettercap Ettercap NG 0.7.3

Discussion

Ettercap Remote Format String Vulnerability

Ettercap is susceptible to a remote format string vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input prior to utilizing it as a format specifier in a formatted printing function.

To exploit this vulnerability, an attacker would craft network data that will result in one of the protocol dissectors logging usernames and passwords. Other means of attack may also be possible.

This vulnerability allows remote attackers to modify arbitrary memory locations, resulting in the control of program execution, leading to the ability to execute arbitrary machine code in the context of the affected application.

This vulnerability is only exploitable when the curses user interface is being utilized by a user.

Exploit / POC

Ettercap Remote Format String Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

Ettercap Remote Format String Vulnerability

Solution:
Gentoo users can upgrade by issuing the following commands:

# emerge --sync
# emerge --ask --oneshot --verbose ">=net-analyzer/ettercap-0.7.3"

The vendor has released version 0.7.3 of Ettercap to address this issue.

Debian Linux has relased security advisory DSA 749-1 addressing this issue. Please see the referenced advisory for details on obtaining and applying the appropriate updates.

Debian has released security advisory DSA 773-1 addressing several issues for their AMD64 port of the operating system. Please see the referenced advisory for further information.

Ettercap Ettercap 0.6 .b