CVE-2026-3606: 
NixOS vulnerability analysis and mitigation

CVE-2026-3606 is a heap-buffer-overflow (out-of-bounds read) vulnerability in Ettercap 0.8.4-Garofalo affecting the add_data_segment function in src/ettercap/utils/etterfilter/ef_output.c. The flaw was discovered and reported via a GitHub issue on February 2, 2026, and publicly disclosed on March 5, 2026. Only Ettercap version 0.8.4-Garofalo is confirmed affected; local access with low privileges is required to trigger the vulnerability. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 1.9 (Low) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper restriction of operations within the bounds of a memory buffer (CWE-119 / CWE-125: Out-of-bounds Read). During filter script compilation by the etterfilter utility, the add_data_segment function in ef_output.c (line 156) performs a memcpy operation that reads 4 bytes from a heap region allocated for only 3 bytes — the buffer is allocated in ef_grammar.y during parsing, but the size logic in write_output incorrectly assumes a minimum length exceeding the actual allocation. An attacker with local access can supply a crafted filter script (a public reproducer is available at github.com/oneafter/0202/blob/main/et/repro) and run etterfilter <repro> -o /dev/null to trigger the crash (GitHub Issue #1297, Repro File).

Successful exploitation causes a denial-of-service condition by crashing the etterfilter process due to an AddressSanitizer-detected heap-buffer-overflow. There is no confidentiality or integrity impact — the vulnerability is limited to availability, specifically causing the etterfilter component to abort abnormally. Because etterfilter is a local utility used to compile filter scripts for Ettercap's packet filtering engine, exploitation disrupts filter compilation workflows but does not directly affect live network interception sessions (Red Hat Bugzilla, GitHub Issue #1297).

A public reproducer file has been disclosed at github.com/oneafter/0202/blob/main/et/repro, and the vulnerability was submitted to VulDB (submission #764648), confirming public availability of exploit details. However, no weaponized exploit code or in-the-wild exploitation has been observed, and no threat actor attribution exists. The EPSS score is approximately 0.013% (0.000130), indicating very low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Nessus plugin 301399 is available for detection (Red Hat Advisory, VulDB).

1. Reconnaissance: Identify systems running Ettercap 0.8.4-Garofalo with the etterfilter utility available, requiring local (authenticated) access with low privileges.
2. Prepare malicious filter script: Create or obtain a crafted filter script that causes the parser (ef_grammar.y) to allocate a heap buffer smaller than the size subsequently assumed by add_data_segment — the public reproducer (repro) contains a minimal such script.
3. Trigger compilation: Execute etterfilter <crafted_script> -o /dev/null to invoke write_output → create_data_segment → add_data_segment, which performs an out-of-bounds memcpy read of 4 bytes from a 3-byte allocation.
4. Achieve denial of service: The process aborts with a heap-buffer-overflow error, crashing etterfilter and preventing filter compilation (GitHub Issue #1297, Repro File).

• Process: Unexpected termination of the etterfilter process with an abort signal; crash dumps or core files generated in the working directory.
• Logs: System logs (e.g., /var/log/syslog or journalctl) showing etterfilter process killed by SIGABRT; AddressSanitizer output referencing heap-buffer-overflow in ef_output.c:156 if ASan-enabled builds are in use.
• File System: Presence of unusual or minimal filter script files (e.g., files with malformed or edge-case filter syntax) in directories accessible to low-privileged users; unexpected /dev/null output targets in command history.
• Command History: Shell history entries containing etterfilter <file> -o /dev/null or similar invocations with non-standard input files (GitHub Issue #1297).

No official upstream patch from the Ettercap project has been released as of the disclosure date, and the project had not responded to the issue report at time of publication. Red Hat has tracked the issue via Bugzilla (Bug 2445008) and patch guidance should be monitored there. As interim mitigations: restrict local user access to systems running Ettercap 0.8.4-Garofalo, limit execution of etterfilter to trusted users only, and consider disabling etterfilter functionality in critical environments until a fix is available. Monitor the Ettercap GitHub repository and Red Hat Bugzilla for patch releases (Red Hat Bugzilla, Ettercap GitHub).

The vulnerability received routine coverage from automated vulnerability tracking services including VulDB, Vulners, and CVEFeed shortly after disclosure. A Bluesky post from a CVE tracking account and a Mastodon post from VulDB noted the disclosure. SOS Intelligence included it in their weekly CVE chatter top-ten for the week of March 23, 2026. No significant vendor statements beyond Red Hat's Bugzilla tracking entry or notable independent researcher commentary have been identified (VulDB Mastodon, Red Hat Advisory).