CVE-2010-3843

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-28 · updated 2026-06-16
Weakness: CWE-787

Description

The GTK version of ettercap uses a global settings file at /tmp/.ettercap_gtk and does not verify ownership of this file. When parsing this file for settings in gtkui_conf_read() (src/interfacesgtk/ec_gtk_conf.c), an unchecked sscanf() call allows a maliciously placed settings file to overflow a statically-sized buffer on the stack.

Affected products

Ettercap: 0.7.3

References

http://article.gmane.org/gmane.comp.security.oss.general/3660
https://bugs.launchpad.net/ubuntu/+source/ettercap/+bug/656347
https://bugzilla.redhat.com/show_bug.cgi?id=643453
http://article.gmane.org/gmane.comp.security.oss.general/3660
https://bugs.launchpad.net/ubuntu/+source/ettercap/+bug/656347
https://bugzilla.redhat.com/show_bug.cgi?id=643453

Get alerted when CVE-2010-3843 or the next vulnerability affects your stack