Ettercap - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/ettercap/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 11 Nov 2026 10:51:55 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgEttercap: Out-of-bounds read vulnerability in NTLM authentication (CVE-2026-125405)https://feed.craftedsignal.io/briefs/2026-11-ettercap-oob-read/Wed, 11 Nov 2026 10:51:55 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-ettercap-oob-read/Ettercap through version 0.8.4.1 contains an out-of-bounds read vulnerability in the Parse_NTLM_Auth function, allowing remote attackers to trigger memory disclosure or process crashes via crafted HTTP Authorization headers.Ettercap versions through 0.8.4.1 are susceptible to an out-of-bounds read vulnerability within the Parse_NTLM_Auth() function located in src/dissectors/ec_http.c. The vulnerability stems from improper validation of NTLM message offsets when the tool processes HTTP Authorization headers. A remote attacker can exploit this by sending a specially crafted HTTP request observed by the target Ettercap instance. Depending on the memory layout, this may lead to sensitive information disclosure or a denial-of-service condition via process termination.

Impact

Successful exploitation allows for the disclosure of arbitrary process memory or a crash of the Ettercap process, potentially disrupting network traffic interception or analysis tasks.

Recommendation

  • Inventory environments where Ettercap 0.8.4.1 or earlier is deployed for network monitoring or security testing.
  • Monitor for updates from the Ettercap project and upgrade to the patched version once released.
  • Restrict network access to monitoring instances to only trusted sources to mitigate the risk of an attacker sending malicious HTTP headers to be processed by the tool.
]]>highadvisoryvulnerabilityettercapnetwork-securitymemory-safety