Re:Potential hole in Ettercap 0.6.2

[ALoR <Alor () iol it>]

At 19.44 04-12-2001, you wrote:
> It is not configured as default from their source forge distrobution 
> files. I did find out that that using %s instead of %x caused it do dump 
> the current working directory:
>
>
> Pretty strange no dbout, but since you can't run as a regular user no real 
> security implications...

Right, by default the suid option is disabled. and to suid it you have to 
recompile it with an explict option.

btw the next version will be fixed.

<full disclosure>
the problem was a forgotten "printf(buffer)" in the Interface_WExit(char 
*buffer) function.
so to fix it simply replace the line 1252 of ec_interface.c with 
printf("%s", buffer);
</full disclosure>

bye

   --==> ALoR <==---------------------- -  -   -

 ettercap project : http://ettercap.sourceforge.net
 e-mail: alor (at) users (dot) sourceforge (dot) net