Heap Out-of-Bounds Read in Ettercap SSL Interception

Executive Summary

CVE-2026-125402 is a heap out-of-bounds read flaw in Ettercap versions 0.8.4.1 and earlier. It occurs in the TLS Server Name Indication (SNI) extension parsing function sslw_get_clienthello_sni() during SSL Man-in-the-Middle attacks. The function reads a 16-bit length value from the SNI extension without validating it against the actual extension length, allowing attackers to control how many bytes are read beyond the buffer. This can leak up to 64 KB of heap memory or crash Ettercap.

The vulnerability requires SSL MITM to be active and the build to have HAVE_OPENSSL_1_1_1. The issue arises because the attacker-controlled length value is not checked against the true extension length before copying.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor Ettercap logs for crashes or unusual memory access errors during SSL/TLS interception. Check for heap memory leaks or crashes when processing TLS ClientHello messages with crafted SNI extensions. Use network traffic analysis tools like Wireshark to inspect TLS handshakes for malformed SNI fields.

Useful 0 Not Useful 0

Impact Analysis

Network-adjacent attackers can exploit this to leak sensitive heap memory or crash Ettercap during SSL interception. This may expose confidential data processed by Ettercap or disrupt its operation. The impact depends on Ettercap's usage in your environment, such as SSL interception for monitoring or testing.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive data during SSL/TLS interception, potentially violating GDPR's data protection requirements and HIPAA's confidentiality rules if exploited in healthcare environments.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Ettercap to a patched version (later than 0.8.4.1). Disable SSL/TLS interception if not required. Apply input validation patches for SNI length fields in TLS parsing. Monitor network traffic for suspicious TLS ClientHello messages with abnormal SNI lengths.

Useful 0 Not Useful 0