CVE-2010-3843

EUVD-2010-3822
The GTK version of ettercap uses a global settings file at /tmp/.ettercap_gtk and does not verify ownership of this file. When parsing this file for settings in gtkui_conf_read() (src/interfacesgtk/ec_gtk_conf.c), an unchecked sscanf() call allows a maliciously placed settings file to overflow a statically-sized buffer on the stack.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 16%
Affected Products (NVD)
VendorProductVersion
ettercap-projectettercap
0.7.3
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
ettercap
bookworm
1:0.8.3.1-11
fixed
bullseye
1:0.8.3.1-3
fixed
sid
1:0.8.3.1-13
fixed
trixie
1:0.8.3.1-13
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
ettercap
artful
ignored
bionic
not-affected
cosmic
not-affected
hardy
ignored
lucid
ignored
natty
ignored
oneiric
ignored
precise
ignored
quantal
ignored
raring
ignored
saucy
ignored
trusty
dne
utopic
ignored
vivid
ignored
wily
ignored
xenial
not-affected
yakkety
ignored
zesty
ignored
Common Weakness Enumeration
References
http://article.gmane.org/gmane.comp.security.oss.general/3660
https://bugs.launchpad.net/ubuntu/+source/ettercap/+bug/656347
https://bugzilla.redhat.com/show_bug.cgi?id=643453
http://article.gmane.org/gmane.comp.security.oss.general/3660
https://bugs.launchpad.net/ubuntu/+source/ettercap/+bug/656347
https://bugzilla.redhat.com/show_bug.cgi?id=643453