CVE-2017-6430: Out-of-bounds Read (CWE-125)
value: The compile_tree function in ef_compiler.c in the Etterfilter utility in Ettercap 0.8.2 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted filter.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.5
Published: 2017-03-15T15:59Z
Repository: https://github.com/LocutusOfBorg/ettercap
Language: C
Files changed: utils/etterfilter/ef_compiler.c, utils/etterfilter/ef_main.c, utils/etterfilter/ef_output.c
Commit date: 2017-02-09 16:01:30 +0100
Commit message: Exit gracefully in case of corrupted filters (Closes issue #782)

Diff: diff --git a/utils/etterfilter/ef_compiler.c b/utils/etterfilter/ef_compiler.c
index 4ca676c2..dc26043f 100644
--- a/utils/etterfilter/ef_compiler.c
+++ b/utils/etterfilter/ef_compiler.c
@@ -237,11 +237,13 @@ size_t compile_tree(struct filter_op **fop)
 {
    int i = 1;
    struct filter_op *array = NULL;
    struct unfold_elm *ue;
 
-   BUG_IF(tree_root == NULL);
+   // invalid file
+   if (tree_root == NULL)
+      return 0;
   
    fprintf(stdout, " Unfolding the meta-tree ");
    fflush(stdout);
      
    /* start the recursion on the tree */
diff --git a/utils/etterfilter/ef_main.c b/utils/etterfilter/ef_main.c
index f17b83b2..2a2f0007 100644
--- a/utils/etterfilter/ef_main.c
+++ b/utils/etterfilter/ef_main.c
@@ -39,10 +39,11 @@ struct ef_globals *ef_gbls;
 
 /*******************************************/
 
 int main(int argc, char *argv[])
 {
+   int ret_value = 0;
    libettercap_init();
    ef_globals_alloc();
    select_text_interface();
    libettercap_ui_init();
    /* etterfilter copyright */
@@ -86,12 +87,16 @@ int main(int argc, char *argv[])
       fprintf(stdout, " done.\n\n");
    else
       fprintf(stdout, "\n\nThe script contains errors...\n\n");
   
    /* write to file */
-   if (write_output() != E_SUCCESS)
-      FATAL_ERROR("Cannot write output file (%s)", EF_GBL_OPTIONS->output_file);
+   ret_value = write_output();
+   if (ret_value == -E_NOTHANDLED)
+      FATAL_ERROR("Cannot write output file (%s): the filter is not correctly handled.", EF_GBL_OPTIONS->output_file);
+   else if (ret_value == -E_INVALID)
+      FATAL_ERROR("Cannot write output file (%s): the filter format is not correct. ", EF_GBL_OPTIONS->output_file);
+
    ef_globals_free();
    return 0;
 }
 
 
diff --git a/utils/etterfilter/ef_output.c b/utils/etterfilter/ef_output.c
index 57e6b00a..08c32fcb 100644
--- a/utils/etterfilter/ef_output.c
+++ b/utils/etterfilter/ef_output.c
@@ -49,10 +49,13 @@ int write_output(void)
    ninst = compile_tree(&fop);
 
    if (fop == NULL)
       return -E_NOTHANDLED;
 
+   if (ninst == 0)
+      return -E_INVALID;
+
    /* create the file */
    fd = open(EF_GBL_OPTIONS->output_file, O_CREAT | O_RDWR | O_TRUNC | O_BINARY, 0644);
    ON_ERROR(fd, -1, "Can't create file %s", EF_GBL_OPTIONS->output_file);
 
    /* display the message */

Vulnerable code:    BUG_IF(tree_root == NULL);
   if (write_output() != E_SUCCESS)
      FATAL_ERROR("Cannot write output file (%s)", EF_GBL_OPTIONS->output_file);
Fixed code:    // invalid file
   if (tree_root == NULL)
      return 0;
   int ret_value = 0;
   ret_value = write_output();
   if (ret_value == -E_NOTHANDLED)
      FATAL_ERROR("Cannot write output file (%s): the filter is not correctly handled.", EF_GBL_OPTIONS->output_file);
   else if (ret_value == -E_INVALID)
      FATAL_ERROR("Cannot write output file (%s): the filter format is not correct. ", EF_GBL_OPTIONS->output_file);

   if (ninst == 0)
      return -E_INVALID;