{"id":482,"date":"2016-09-09T16:12:20","date_gmt":"2016-09-09T14:12:20","guid":{"rendered":"http:\/\/blogs.gentoo.org\/ago\/?p=482"},"modified":"2016-09-09T16:12:20","modified_gmt":"2016-09-09T14:12:20","slug":"ettercap-etterlog-null-pointer-dereference-in-fingerprint_search-ec_fingerprint-c","status":"publish","type":"post","link":"https:\/\/blogs.gentoo.org\/ago\/2016\/09\/09\/ettercap-etterlog-null-pointer-dereference-in-fingerprint_search-ec_fingerprint-c\/","title":{"rendered":"ettercap: etterlog: NULL pointer dereference in fingerprint_search (ec_fingerprint.c)"},"content":{"rendered":"

Description<\/strong>:
\nettercap<\/a> is a comprehensive suite for man in the middle attacks.<\/p>\n

Etterlog, which is part of the package, fails to read malformed data produced from the fuzzer and makes visible a NULL pointer access.<\/p>\n

The complete ASan output:<\/p>\n

# etterlog $FILE\r\nLog file version    : 0.8.2                                                                                                                                                                    \r\nTimestamp           : Thu Jul 16 15:28:54 2015 [688192]                                                                                                                                        \r\nType                : LOG_INFO                                                                                                                                                                 \r\n\r\n1766 tcp OS fingerprint                                                                                                                                                                        \r\n\r\n20530 mac vendor fingerprint                                                                                                                                                                   \r\n\r\n2182 known services                                                                                                                                                                            \r\n\r\nASAN:DEADLYSIGNAL                                                                                                                                                                              \r\n=================================================================                                                                                                                              \r\n==9987==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7f4671a428b2 bp 0x7ffd1cdbf5b0 sp 0x7ffd1cdbf540 T0)                                                             \r\n    #0 0x7f4671a428b1 in fingerprint_search \/tmp\/portage\/net-analyzer\/ettercap-9999\/work\/ettercap-9999\/src\/ec_fingerprint.c:189:17                                                             \r\n    #1 0x7f4671a6ee4e in print_host \/tmp\/portage\/net-analyzer\/ettercap-9999\/work\/ettercap-9999\/src\/ec_passive.c:120:8                                                                          \r\n    #2 0x4fe769 in display_info \/tmp\/portage\/net-analyzer\/ettercap-9999\/work\/ettercap-9999\/utils\/etterlog\/el_display.c:277:10                                                                  \r\n    #3 0x4fe769 in display \/tmp\/portage\/net-analyzer\/ettercap-9999\/work\/ettercap-9999\/utils\/etterlog\/el_display.c:52                                                                           \r\n    #4 0x507818 in main \/tmp\/portage\/net-analyzer\/ettercap-9999\/work\/ettercap-9999\/utils\/etterlog\/el_main.c:94:4                                                                               \r\n    #5 0x7f46706e561f in __libc_start_main \/var\/tmp\/portage\/sys-libs\/glibc-2.22-r4\/work\/glibc-2.22\/csu\/libc-start.c:289                                                                        \r\n    #6 0x41a408 in _start (\/usr\/bin\/etterlog+0x41a408)                                                                                                                                         \r\n\r\nAddressSanitizer can not provide additional info.                                                                                                                                              \r\nSUMMARY: AddressSanitizer: SEGV \/tmp\/portage\/net-analyzer\/ettercap-9999\/work\/ettercap-9999\/src\/ec_fingerprint.c:189:17 in fingerprint_search                                                   \r\n==9987==ABORTING                                                                                                                                                                               \r\n\r\netterlog 0.8.2 copyright 2001-2015 Ettercap Development Team                                                                                                                                   \r\n\r\n\r\n\r\n==================================================\r\n IP address   : 192.168.0.31 \r\n\r\n MAC address  : 34:17:EB:9B:21:AD \r\n MANUFACTURER : Dell Inc \r\n\r\n DISTANCE     : 0   \r\n TYPE         : LAN host\r\n\r\n FINGERPRINT      : \ufffd\r\n<\/font><\/pre>\n
Affected version:<\/strong>
\n0.8.2<\/p>\n
Fixed version:<\/strong>
\nN\/A<\/p>\n
Commit fix:<\/strong>
\nN\/A<\/p>\n
Credit:<\/strong>
\nThis bug was discovered by Agostino Sarubbo of Gentoo.<\/p>\n
CVE:<\/strong>
\nN\/A<\/p>\n
Timeline:<\/strong>
\n2016-08-10: bug discovered
\n2016-08-11: bug reported to upstream
\n2016-09-09: blog post about the issue<\/p>\n
Note:<\/strong>
\nThis bug was found with American Fuzzy Lop<\/a>.
\nThe stacktrace is about a git version compiled when I reported the bug to upstream, but is reproducible with 0.8.2 too.<\/p>\n
Permalink:<\/strong><\/p>\n
ettercap: etterlog: NULL pointer dereference in fingerprint_search (ec_fingerprint.c)<\/a><\/p><\/blockquote>\n