Threats affecting pkg:github/ettercap

Ettercap versions up to 0.8.4.1 have a stack buffer underwrite vulnerability in the telnet dissector. This flaw occurs because the code decrements an output pointer on backspace characters without checking if it goes below the buffer start. An attacker can exploit this by sending a telnet stream with excessive backspaces, causing memory corruption in the Ettercap process, which typically runs with root privileges.

Ettercap versions up to and including 0.8.4.1 have an out-of-bounds read vulnerability in the Parse_NTLM_Auth() function due to unvalidated NTLM message offsets. This flaw allows an attacker to send a crafted HTTP Authorization header that causes Ettercap to read beyond the intended buffer, potentially disclosing memory contents or causing the process to crash.

CVE-2026-125404 is an integer underflow vulnerability in Ettercap versions up to 0.8.4.1. The flaw exists in the ccmp_decrypt() function, which subtracts the 8-byte CCMP trailer without verifying the minimum length of the input. This can allow an attacker on the same network, with access to the WPA key, to send a specially crafted short CCMP frame that triggers a stack buffer overflow in the Ettercap process, which typically runs with root privileges.

CVE-2026-125403 is an out-of-bounds read and size_t underflow vulnerability in Ettercap versions up to 0.8.4.1. It occurs in the sslw_remove_sts() function when processing Strict-Transport-Security headers during SSL interception. A malicious HTTPS server response can trigger memory corruption in the Ettercap process, which typically runs with root privileges.

Ettercap versions up to 0.8.4.1 have a heap out-of-bounds read vulnerability in the sslw_get_clienthello_sni() function. This flaw arises from trusting an unchecked 16-bit Server Name Indication (SNI) length field in TLS ClientHello messages. An attacker on the network adjacent to the victim can exploit this by sending crafted TLS ClientHello messages during SSL interception, potentially leaking up to 64 KB of heap memory or causing Ettercap to crash.

CVE-2026-125401 is a heap-based buffer overflow vulnerability in Ettercap versions up to 0.8.4.1. The flaw exists in the gg_get_version() function in src/dissectors/ec_gg.c, where up to 44 bytes can be written into a 30-byte buffer. This can be triggered remotely by sending crafted Gadu-Gadu protocol traffic on TCP port 8074 through a monitored network. The Ettercap process typically runs with root privileges, increasing the potential impact of exploitation.

Ettercap versions up to 0.8.4.1 contain a use-after-free vulnerability in the func_pcre() function within src/ec_filter.c. This flaw occurs when the program reads the PCRE2 ovector after freeing match data. Network-adjacent attackers can exploit this by sending packets that match a loaded pcre_regex() substitution filter, potentially leading to memory corruption and arbitrary code execution with root privileges.