From 4f2d7949f03e1c198bc888f2d05f421d35c57e21 Mon Sep 17 00:00:00 2001 From: V3n3RiX Date: Mon, 9 Oct 2017 18:53:29 +0100 Subject: reinit the tree, so we can have metadata --- metadata/glsa/glsa-201405-12.xml | 65 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 65 insertions(+) create mode 100644 metadata/glsa/glsa-201405-12.xml (limited to 'metadata/glsa/glsa-201405-12.xml') diff --git a/metadata/glsa/glsa-201405-12.xml b/metadata/glsa/glsa-201405-12.xml new file mode 100644 index 000000000000..55793389e723 --- /dev/null +++ b/metadata/glsa/glsa-201405-12.xml @@ -0,0 +1,65 @@ + + + + Ettercap: Multiple vulnerabilities + Multiple vulnerabilities have been found in Ettercap, the worst of + which may allow execution of arbitrary code. + + ettercap + 2014-05-17 + 2014-05-17: 1 + 340897 + 451198 + remote + + + 0.7.5.2 + 0.7.5.2 + + + +

Ettercap is a suite of tools for content filtering, sniffing and man in + the middle attacks on a LAN. +

+ + +

Multiple vulnerabilities have been discovered in Ettercap:

+ +
    +
  • Ettercap does not handle temporary files securely (CVE-2010-3843).
    • +
  • A format string flaw in Ettercap could cause a buffer overflow + (CVE-2010-3844). +
    • +
  • A stack-based buffer overflow exists in Ettercap (CVE-2013-0722).
    • +
+ + +

A remote attacker could entice a user to load a specially crafted + configuration file using Ettercap, possibly resulting in execution of + arbitrary code with the privileges of the process or a Denial of Service + condition. +

+ +

A local attacker could perform symlink attacks to overwrite arbitrary + files with the privileges of the user running the application. +

+ + +

There is no known workaround at this time.

+ + +

All Ettercap users should upgrade to the latest version:

+ + + # emerge --sync + # emerge --ask --oneshot --verbose ">=net-analyzer/ettercap-0.7.5.2" + + + + CVE-2010-3843 + CVE-2010-3844 + CVE-2013-0722 + + ackle + ackle + -- cgit v1.2.3