Re:Potential hole in Ettercap 0.6.2

From: ALoR (Alorat_private)
Date: Tue Dec 04 2001 - 12:52:16 PST

  • Next message: Jose Nazario: "Re:Potential hole in Ettercap 0.6.2"

    At 19.44 04-12-2001, you wrote:
    >It is not configured as default from their source forge distrobution 
    >files. I did find out that that using %s instead of %x caused it do dump 
    >the current working directory:
    >
    >
    >Pretty strange no dbout, but since you can't run as a regular user no real 
    >security implications...
    
    Right, by default the suid option is disabled. and to suid it you have to 
    recompile it with an explict option.
    
    btw the next version will be fixed.
    
    <full disclosure>
    the problem was a forgotten "printf(buffer)" in the Interface_WExit(char 
    *buffer) function.
    so to fix it simply replace the line 1252 of ec_interface.c with 
    printf("%s", buffer);
    </full disclosure>
    
    bye
    
        --==> ALoR <==---------------------- -  -   -
    
      ettercap project : http://ettercap.sourceforge.net
      e-mail: alor (at) users (dot) sourceforge (dot) net
    



    This archive was generated by hypermail 2b30 : Tue Dec 04 2001 - 13:33:23 PST