{"id":"CVE-2010-3843","aliases":["DEBIAN-CVE-2010-3843","EUVD-2010-3822","GHSA-2w85-hj5c-563j","UBUNTU-CVE-2010-3843"],"status":"published","title":"The gtkui_conf_read function in src/interfaces/gtk/ec_gtk_conf.c in Ettercap 0.7.3, when the GTK...","description":"The GTK version of ettercap uses a global settings file at /tmp/.ettercap_gtk and does not verify ownership of this file. When parsing this file for settings in gtkui_conf_read() (src/interfacesgtk/ec_gtk_conf.c), an unchecked sscanf() call allows a maliciously placed settings file to overflow a statically-sized buffer on the stack.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00313,"percentile":0.24364,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120","CWE-787"],"published":"2021-05-28T12:14:46Z","modified":"2026-10-23T18:02:43Z","fixes":[{"ecosystem":"Debian:12","package":"ettercap","fixed_in":["1:0.7.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ettercap","fixed_in":["1:0.7.4-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ettercap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ettercap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.4-1"}]}]}],"products":[{"vendor":"ettercap-project","product":"ettercap"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=643453","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","advisory","report"]},{"url":"https://bugs.launchpad.net/ubuntu/+source/ettercap/+bug/656347","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"http://article.gmane.org/gmane.comp.security.oss.general/3660","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3843"},{"url":"http://secunia.com/advisories/41820"},{"url":"http://www.openwall.com/lists/oss-security/2010/10/13/2"},{"url":"http://www.openwall.com/lists/oss-security/2010/10/13/6"},{"url":"http://www.openwall.com/lists/oss-security/2010/10/14/1"},{"url":"http://www.openwall.com/lists/oss-security/2010/10/14/2"},{"url":"https://github.com/advisories/GHSA-2w85-hj5c-563j"},{"url":"https://security-tracker.debian.org/tracker/CVE-2010-3843","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2010-3843","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2010-3843","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2010-3843","description":"The GTK version of ettercap uses a global settings file at /tmp/.ettercap_gtk and does not verify ownership of this file. When parsing this file for settings in gtkui_conf_read() (src/interfacesgtk/ec_gtk_conf.c), an unchecked sscanf() call allows a maliciously placed settings file to overflow a statically-sized buffer on the stack.","status":"published","published":"2021-05-28T12:14:46Z","modified":"2024-08-07T03:26:12.157Z","cwes":["CWE-787"],"updated_at":"2026-11-02T14:33:28.115387Z"}],"euvd":[{"id":"EUVD-2010-3822","description":"The GTK version of ettercap uses a global settings file at /tmp/.ettercap_gtk and does not verify ownership of this file. When parsing this file for settings in gtkui_conf_read() (src/interfacesgtk/ec_gtk_conf.c), an unchecked sscanf() call allows a maliciously placed settings file to overflow a statically-sized buffer on the stack.","status":"published","published":"2021-05-28T12:14:46Z","modified":"2024-08-07T03:26:12Z","updated_at":"2026-11-03T01:39:32.539513Z"}],"ghsa":[{"id":"GHSA-2w85-hj5c-563j","title":"The gtkui_conf_read function in src/interfaces/gtk/ec_gtk_conf.c in Ettercap 0.7.3, when the GTK...","description":"The gtkui_conf_read function in src/interfaces/gtk/ec_gtk_conf.c in Ettercap 0.7.3, when the GTK interface is used, does not ensure that the contents of the .ettercap_gtk file are controlled by the root user, which allows local users to conduct stack-based buffer overflow attacks and possibly execute arbitrary code, cause a denial of service (memory consumption), or possibly have unspecified other impact via crafted lines in this file.","status":"published","published":"2022-04-21T01:57:53Z","modified":"2023-01-27T05:01:48Z","cwes":["CWE-120","CWE-787"],"updated_at":"2026-11-02T14:41:58.364763Z"}],"nvd":[{"id":"CVE-2010-3843","description":"The GTK version of ettercap uses a global settings file at /tmp/.ettercap_gtk and does not verify ownership of this file. When parsing this file for settings in gtkui_conf_read() (src/interfacesgtk/ec_gtk_conf.c), an unchecked sscanf() call allows a maliciously placed settings file to overflow a statically-sized buffer on the stack.","status":"published","published":"2021-05-28T13:15:07.283Z","modified":"2026-06-16T23:23:39.47Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:02:04.957683Z"}],"osv":[{"id":"CVE-2010-3843","description":"The GTK version of ettercap uses a global settings file at /tmp/.ettercap_gtk and does not verify ownership of this file. When parsing this file for settings in gtkui_conf_read() (src/interfacesgtk/ec_gtk_conf.c), an unchecked sscanf() call allows a maliciously placed settings file to overflow a statically-sized buffer on the stack.","status":"published","published":"2021-05-28T13:15:07Z","modified":"2026-04-10T03:41:27.172998Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:43:57.991581Z"},{"id":"DEBIAN-CVE-2010-3843","description":"The GTK version of ettercap uses a global settings file at /tmp/.ettercap_gtk and does not verify ownership of this file. When parsing this file for settings in gtkui_conf_read() (src/interfacesgtk/ec_gtk_conf.c), an unchecked sscanf() call allows a maliciously placed settings file to overflow a statically-sized buffer on the stack.","status":"published","published":"2021-05-28T13:15:07.283Z","modified":"2026-10-23T18:02:43.671995808Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:24.316685Z"},{"id":"UBUNTU-CVE-2010-3843","description":"The GTK version of ettercap uses a global settings file at /tmp/.ettercap_gtk and does not verify ownership of this file. When parsing this file for settings in gtkui_conf_read() (src/interfacesgtk/ec_gtk_conf.c), an unchecked sscanf() call allows a maliciously placed settings file to overflow a statically-sized buffer on the stack.","status":"withdrawn","published":"2021-05-28T13:15:00Z","modified":"2025-07-16T07:16:58.376243Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:06.395274Z"}]}}