{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/ettercap/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:ettercap:ettercap:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-125405"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Ettercap (\u003c= 0.8.4.1)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","ettercap","network-security","memory-safety"],"_cs_type":"advisory","_cs_vendors":["Ettercap"],"content_html":"\u003cp\u003eEttercap versions through 0.8.4.1 are susceptible to an out-of-bounds read vulnerability within the \u003ccode\u003eParse_NTLM_Auth()\u003c/code\u003e function located in \u003ccode\u003esrc/dissectors/ec_http.c\u003c/code\u003e. The vulnerability stems from improper validation of NTLM message offsets when the tool processes HTTP Authorization headers. A remote attacker can exploit this by sending a specially crafted HTTP request observed by the target Ettercap instance. Depending on the memory layout, this may lead to sensitive information disclosure or a denial-of-service condition via process termination.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the disclosure of arbitrary process memory or a crash of the Ettercap process, potentially disrupting network traffic interception or analysis tasks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory environments where Ettercap 0.8.4.1 or earlier is deployed for network monitoring or security testing.\u003c/li\u003e\n\u003cli\u003eMonitor for updates from the Ettercap project and upgrade to the patched version once released.\u003c/li\u003e\n\u003cli\u003eRestrict network access to monitoring instances to only trusted sources to mitigate the risk of an attacker sending malicious HTTP headers to be processed by the tool.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-11T10:51:55Z","date_published":"2026-11-11T10:51:55Z","id":"https://feed.craftedsignal.io/briefs/2026-11-ettercap-oob-read/","summary":"Ettercap through version 0.8.4.1 contains an out-of-bounds read vulnerability in the Parse_NTLM_Auth function, allowing remote attackers to trigger memory disclosure or process crashes via crafted HTTP Authorization headers.","title":"Ettercap: Out-of-bounds read vulnerability in NTLM authentication (CVE-2026-125405)","url":"https://feed.craftedsignal.io/briefs/2026-11-ettercap-oob-read/"}],"language":"en","title":"CraftedSignal Threat Feed - Ettercap","version":"https://jsonfeed.org/version/1.1"}