Out-of-Bounds Read in Ettercap NTLM Authentication

Executive Summary

Ettercap through 0.8.4.1 has an out-of-bounds read flaw in the Parse_NTLM_Auth() function located in src/dissectors/ec_http.c. This issue arises because the function does not validate NTLM message offsets properly. Attackers can exploit this by sending a specially crafted HTTP Authorization header, which Ettercap processes. This leads to reading beyond the allocated buffer, potentially exposing sensitive memory contents or causing the application to crash.

Useful 0 Not Useful 0

Detection Guidance

Detect Ettercap instances on your network by checking for unusual HTTP traffic patterns or NTLM authentication headers. Use tools like tcpdump or Wireshark to inspect HTTP Authorization headers for malformed NTLM messages. Monitor Ettercap logs for crashes or memory disclosure events.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to read sensitive memory data or crash Ettercap, disrupting network monitoring and analysis. If exploited in a network where Ettercap is used for security purposes, it may lead to information disclosure or denial-of-service conditions, impacting the reliability of network security tools.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized memory disclosure, potentially exposing sensitive data such as credentials or session information. For GDPR, this may result in unauthorized access to personal data, violating principles of data protection and user consent. For HIPAA, it could compromise protected health information if credentials or session data are exposed.

Useful 0 Not Useful 0

Mitigation Strategies

Update Ettercap to the latest version beyond 0.8.4.1. Block or filter malformed HTTP Authorization headers at the network perimeter. Disable NTLM authentication if not required. Monitor for crashes or memory leaks in Ettercap processes.

Useful 0 Not Useful 0