Re:Potential hole in Ettercap 0.6.2

At 19.44 04-12-2001, you wrote:
>It is not configured as default from their source forge distrobution
>files. I did find out that that using %s instead of %x caused it do dump
>the current working directory:
>
>
>Pretty strange no dbout, but since you can't run as a regular user no real
>security implications...

Right, by default the suid option is disabled. and to suid it you have to
recompile it with an explict option.

btw the next version will be fixed.

<full disclosure>
the problem was a forgotten "printf(buffer)" in the Interface_WExit(char
*buffer) function.
so to fix it simply replace the line 1252 of ec_interface.c with
printf("%s", buffer);
</full disclosure>

bye

    --==> ALoR <==---------------------- - - -

  ettercap project : http://ettercap.sourceforge.net
  e-mail: alor (at) users (dot) sourceforge (dot) net
Received on Dec 04 2001