PT-2014-8976 · Ettercap · Ettercap

Nicksampanis · Published 2014-12-19 · Updated 2020-02-26 · CVE-2014-9381

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Ettercap version 0.8.1

Description The issue is caused by an integer signedness error in the dissector cvs function, which can be exploited by remote attackers to cause a denial of service (crash) via a crafted password. This triggers a large memory allocation.

Recommendations For Ettercap version 0.8.1, consider disabling the dissector cvs function as a temporary workaround until a patch is available. Restrict access to the affected function to minimize the risk of exploitation. Avoid using crafted passwords in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2014-9381

DLA-126-1

MGASA-2015-0012

Affected Products

Ettercap

References · 12

• https://github.com/Ettercap/ettercap/pull/609 · Patch
• https://advisories.mageia.org/MGASA-2015-0012.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-9381 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-9381 · Vendor Advisory
• https://security.gentoo.org/glsa/201505-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-9381 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-9381 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0012 · Vendor Advisory
• http://securityfocus.com/archive/1/534248/100/0/threaded · Note
• https://obrela.com/home/security-labs/advisories/osi-advisory-osi-1402 · Note
• https://bugs.mageia.org/show_bug.cgi?id=14919 · Note
• http://securityfocus.com/bid/71693 · Note