{"id":"CVE-2014-9381","aliases":["DEBIAN-CVE-2014-9381","DLA-126-1","EUVD-2014-9203","GHSA-48qw-96c7-m2c9","MGASA-2015-0012"],"status":"published","title":"Integer signedness error in the dissector_cvs function in dissectors/ec_cvs.c in Ettercap 0.8.1...","description":"Integer signedness error in the dissector_cvs function in dissectors/ec_cvs.c in Ettercap 0.8.1 allows remote attackers to cause a denial of service (crash) via a crafted password, which triggers a large memory allocation.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02791,"percentile":0.86514,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-189"],"published":"2014-12-19T15:00:00Z","modified":"2026-10-23T15:47:32Z","fixes":[{"ecosystem":"Debian:12","package":"ettercap","fixed_in":["1:0.8.1-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ettercap","fixed_in":["1:0.8.1-3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ettercap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.8.1-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ettercap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.8.1-3"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"ettercap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.7.3-2.1+squeeze2"}]}],"versions":["1:0.7.3-2.1","1:0.7.3-2.1+squeeze1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:4","package":"ettercap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0-3.1.mga4"}]}],"bundled":8}],"products":[{"vendor":"ettercap-project","product":"ettercap"}],"references":[{"url":"https://security.gentoo.org/glsa/201505-01","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"https://www.obrela.com/home/security-labs/advisories/osi-advisory-osi-1402/","tags":["x_refsource_MISC","x_transferred","Broken Link","advisory"]},{"url":"http://www.securityfocus.com/bid/71693","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.securityfocus.com/archive/1/534248/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"https://github.com/Ettercap/ettercap/pull/609","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9381"},{"url":"https://www.obrela.com/home/security-labs/advisories/osi-advisory-osi-1402"},{"url":"https://github.com/advisories/GHSA-48qw-96c7-m2c9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-9381","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0012.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14919","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-9381","description":"Integer signedness error in the dissector_cvs function in dissectors/ec_cvs.c in Ettercap 0.8.1 allows remote attackers to cause a denial of service (crash) via a crafted password, which triggers a large memory allocation.","status":"published","published":"2014-12-19T15:00:00Z","modified":"2024-08-06T13:40:25.164Z","updated_at":"2026-11-02T14:33:42.54191Z"}],"euvd":[{"id":"EUVD-2014-9203","description":"Integer signedness error in the dissector_cvs function in dissectors/ec_cvs.c in Ettercap 0.8.1 allows remote attackers to cause a denial of service (crash) via a crafted password, which triggers a large memory allocation.","status":"published","published":"2014-12-19T15:00:00Z","modified":"2024-08-06T13:40:25Z","updated_at":"2026-11-03T01:56:49.310799Z"}],"ghsa":[{"id":"GHSA-48qw-96c7-m2c9","title":"Integer signedness error in the dissector_cvs function in dissectors/ec_cvs.c in Ettercap 0.8.1...","description":"Integer signedness error in the dissector_cvs function in dissectors/ec_cvs.c in Ettercap 0.8.1 allows remote attackers to cause a denial of service (crash) via a crafted password, which triggers a large memory allocation.","status":"published","published":"2022-05-13T01:28:03Z","modified":"2025-04-12T12:44:17Z","updated_at":"2026-11-02T15:01:20.346559Z"}],"nvd":[{"id":"CVE-2014-9381","description":"Integer signedness error in the dissector_cvs function in dissectors/ec_cvs.c in Ettercap 0.8.1 allows remote attackers to cause a denial of service (crash) via a crafted password, which triggers a large memory allocation.","status":"published","published":"2014-12-19T15:59:31.567Z","modified":"2026-06-17T00:18:15.693Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-189"],"updated_at":"2026-11-02T14:02:57.680258Z"}],"osv":[{"id":"CVE-2014-9381","description":"Integer signedness error in the dissector_cvs function in dissectors/ec_cvs.c in Ettercap 0.8.1 allows remote attackers to cause a denial of service (crash) via a crafted password, which triggers a large memory allocation.","status":"published","published":"2014-12-19T15:59:31Z","modified":"2026-04-16T06:24:55.628747745Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2014-9381","description":"Integer signedness error in the dissector_cvs function in dissectors/ec_cvs.c in Ettercap 0.8.1 allows remote attackers to cause a denial of service (crash) via a crafted password, which triggers a large memory allocation.","status":"published","published":"2014-12-19T15:59:31.567Z","modified":"2026-10-23T15:47:32.926553218Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"DLA-126-1","title":"ettercap - security update","status":"published","published":"2014-12-29T00:00:00Z","modified":"2026-03-09T01:01:18.021457Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"MGASA-2015-0012","title":"Updated ettercap packages fix security vulnerabilities","description":"Updated ettercap package fixes security vulnerabilities:\n\nHeap-based buffer overflow in the dissector_postgresql function in\ndissectors/ec_postgresql.c in Ettercap before 8.1 allows remote attackers to\ncause a denial of service or possibly execute arbitrary code via a crafted\npassword length value that is inconsistent with the actual length of the\npassword (CVE-2014-6395).\n\nThe dissector_postgresql function in dissectors/ec_postgresql.c in Ettercap\nbefore 8.1 allows remote attackers to cause a denial of service and possibly\nexecute arbitrary code via a crafted password length, which triggers a 0\ncharacter to be written to an arbitrary memory location (CVE-2014-6396).\n\nInteger underflow in Ettercap 8.1 allows remote attackers to cause a denial\nof service (out-of-bounds write) and possibly execute arbitrary code via a\nsmall size variable value in the dissector_dhcp function in\ndissectors/ec_dhcp.c, length value to the dissector_gg function in\ndissectors/ec_gg.c, or string length to the get_decode_len function in\nec_utils.c or a request without a username or password to the\ndissector_TN3270 function in dissectors/ec_TN3270.c (CVE-2014-9376).\n\nHeap-based buffer overflow in the nbns_spoof function in\nplug-ins/nbns_spoof/nbns_spoof.c in Ettercap 8.1 allows remote attackers to\ncause a denial of service or possibly execute arbitrary code via a large\nnetbios packet (CVE-2014-9377).\n\nEttercap 8.1 does not validate certain return values, which allows remote\nattackers to cause a denial of service (crash) or possibly execute arbitrary\ncode via a crafted name to the parse_line function in mdns_spoof/mdns_spoof.c\nor base64 encoded password to the dissector_imap function in\ndissectors/ec_imap.c (CVE-2014-9378).\n\nThe radius_get_attribute function in dissectors/ec_radius.c in Ettercap 8.1\nperforms an incorrect cast, which allows remote attackers to cause a denial\nof service (crash) or possibly execute arbitrary code via unspecified\nvectors, which triggers a stack-based buffer overflow (CVE-2014-9379).\n\nThe dissector_cvs function in dissectors/ec_cvs.c in Ettercap 8.1 allows\nremote attackers to cause a denial of service (out-of-bounds read) via a\npacket containing only a CVS_LOGIN signature (CVE-2014-9380).\n\nInteger signedness error in the dissector_cvs function in dissectors/ec_cvs.c\nin Ettercap 8.1 allows remote attackers to cause a denial of service (crash)\nvia a crafted password, which triggers a large memory allocation\n(CVE-2014-9381).\n","status":"published","published":"2015-01-07T16:32:10Z","modified":"2026-04-16T06:25:17.73672265Z","updated_at":"2026-11-02T15:49:39.488462Z"}]}}