Heap Out-of-Bounds Read in Ettercap

Executive Summary

This vulnerability is a heap out-of-bounds read in Ettercap through version 0.8.5.1. It occurs in the dissector_mountd() function which handles NFS mount requests. The issue is that RPC credential and directory lengths are validated separately instead of being checked against the packet's end. This allows attackers on the same network to send a crafted MOUNT MNT call that reads up to 100 bytes past the allocated heap buffer, leaking memory to the console and logs.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor Ettercap logs for heap out-of-bounds read errors or memory leaks during NFS mount operations. Check for unusual console output when Ettercap processes MOUNT MNT calls. Use network traffic analysis tools like Wireshark to inspect packets sent to Ettercap on TCP port 2049 for malformed RPC credentials or directory lengths.

Useful 0 Not Useful 0

Impact Analysis

An attacker on the same network could exploit this to read sensitive memory contents, potentially exposing passwords, encryption keys, or other confidential data. While it doesn't allow direct code execution, the memory leakage could aid in further attacks or provide information for crafting more sophisticated exploits.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using vulnerable Ettercap versions may face compliance violations if the memory leakage exposes personal health information or other regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Ettercap to the latest patched version (0.8.5.2 or later) to fix the heap out-of-bounds read in the mountd dissector. If upgrading is not possible, disable the NFS mountd dissector in Ettercap's configuration or block external access to TCP port 2049 on systems running vulnerable versions.

Useful 0 Not Useful 0