Heap Out-of-Bounds Read in Ettercap SOCKS5 Dissector

Executive Summary

Ettercap through 0.8.5.1 has a heap out-of-bounds read vulnerability in the SOCKS5 dissector function (dissector_socks()) in src/dissectors/ec_socks.c. The issue occurs when Ettercap processes SOCKS5 authentication packets. Attackers can send crafted packets with unchecked username/password lengths, causing Ettercap to read up to 255 bytes past the allocated heap buffer. This exposes sensitive memory contents, which may be logged or printed as captured credentials.

Useful 0 Not Useful 0

Detection Guidance

Monitor Ettercap logs for SOCKS5 authentication errors or crashes. Use network traffic analysis tools like Wireshark to inspect SOCKS5 packets on TCP port 1080 for malformed username/password lengths. Check for heap corruption errors in system logs if Ettercap is running.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows network-adjacent attackers to read sensitive heap memory on systems running vulnerable Ettercap versions. Exposed memory could include captured credentials or other sensitive data logged by Ettercap. The impact includes potential disclosure of confidential information and unauthorized access to network traffic analysis.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized disclosure of sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using vulnerable Ettercap versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Ettercap to a patched version beyond 0.8.5.1. Disable SOCKS5 dissector if unused. Block or monitor TCP port 1080 traffic. Apply network segmentation to limit Ettercap's access to sensitive systems.

Useful 0 Not Useful 0