CVE-2014-6396
HighSummary
The dissector_postgresql function in Ettercap before version 0.8.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted password length, which triggers a 0 character to be written to an arbitrary memory location.
Risk Assessment
Attackers can exploit this vulnerability to disrupt system operations and potentially gain control over it, posing a serious security threat to the organization.
Recommendation
It is recommended to update Ettercap to version 0.8.1 or later to mitigate this vulnerability and to monitor systems for unauthorized access attempts.
Other vulnerabilities in Ettercap
See all- CVE-2014-9379High
The radius_get_attribute function in Ettercap 0.8.1 performs an incorrect cast, allowing remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors, leading to a stack-based buffer overflow.
- CVE-2014-9378High
Ettercap version 0.8.1 does not validate certain return values, allowing remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via crafted data passed to the parse_line or dissector_imap functions.
- CVE-2014-9377High
A heap-based buffer overflow in the nbns_spoof function in Ettercap 0.8.1 can be exploited by remote attackers. Attackers can cause a denial of service or potentially execute arbitrary code by sending a large netbios packet.
- CVE-2014-9376High
An integer underflow in Ettercap 0.8.1 allows remote attackers to cause a denial of service (out-of-bounds write) and possibly execute arbitrary code. This can occur in several functions, including dissector_dhcp, dissector_gg, and dissector_TN3270.
- CVE-2017-8366Critical
The strescape function in ec_strings.c in Ettercap 0.8.2 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted filter that is mishandled by etterfilter.
- CVE-2026-9365Medium
In Ettercap up to version 0.8.3, a heap-based buffer overflow exists in the FUNC_DECODER function of the GG Dissector component (file ec_gg.c). Manipulation of the gg argument can lead to a remote attack, though exploitation is difficult.
Original NVD description (English source)
The dissector_postgresql function in dissectors/ec_postgresql.c in Ettercap before 0.8.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted password length, which triggers a 0 character to be written to an arbitrary memory location.