PT-2014-8976 · Ettercap · Ettercap

Nicksampanis · Publicado 2014-12-19 · Atualizado 2020-02-26 · CVE-2014-9381

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Ettercap version 0.8.1

Description The issue is caused by an integer signedness error in the dissector cvs function, which can be exploited by remote attackers to cause a denial of service (crash) via a crafted password. This triggers a large memory allocation.

Recommendations For Ettercap version 0.8.1, consider disabling the dissector cvs function as a temporary workaround until a patch is available. Restrict access to the affected function to minimize the risk of exploitation. Avoid using crafted passwords in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2014-9381

DLA-126-1

MGASA-2015-0012

Produtos afetados

Ettercap

Referências · 12

• https://github.com/Ettercap/ettercap/pull/609 · Correção
• https://advisories.mageia.org/MGASA-2015-0012.html · Nota de Segurança
• http://securityfocus.com/archive/1/534248/100/0/threaded · Nota
• https://obrela.com/home/security-labs/advisories/osi-advisory-osi-1402 · Nota
• https://bugs.mageia.org/show_bug.cgi?id=14919 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-9381 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-9381 · Aviso do Fabricante
• https://security.gentoo.org/glsa/201505-01 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2014-9381 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2014-9381 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2015-0012 · Aviso do Fabricante
• http://securityfocus.com/bid/71693 · Nota