Out-of-Bounds Read in Ettercap SSL Interception

Executive Summary

CVE-2026-125403 is an out-of-bounds read and size_t underflow vulnerability in Ettercap versions 0.8.4.1 and earlier. It occurs in the sslw_remove_sts() function in src/ec_sslwrap.c due to a stale length value and an unchecked memmem() result when processing Strict-Transport-Security headers. A malicious HTTPS server response can trigger memory corruption in the Ettercap process, which typically runs as root.

Useful 0 Not Useful 0

Detection Guidance

Check Ettercap version with 'ettercap --version' to confirm if it is 0.8.4.1 or earlier. Monitor Ettercap logs for crashes or memory corruption errors during SSL interception. Inspect network traffic for malformed Strict-Transport-Security headers using tools like Wireshark with custom filters for 'sts' or 'Strict-Transport-Security'.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to remote crashes or arbitrary code execution in Ettercap, which runs with root privileges. An attacker can exploit it by sending a crafted HTTPS response through Ettercap's SSL interception, potentially compromising the system integrity and availability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling attackers to intercept, modify, or corrupt sensitive data transmitted over HTTPS. Since Ettercap runs as root and handles SSL/TLS traffic, exploitation could lead to unauthorized access to personal or health data, violating confidentiality and integrity requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Ettercap to the latest version that patches this vulnerability. Disable SSL interception in Ettercap if not required. Implement network monitoring to detect active SSL MITM or sslstrip attacks. Restrict Ettercap to run with minimal privileges if SSL interception is necessary.

Useful 0 Not Useful 0