PT-2026-141227

Ettercap through 0.8.4.1 contains an integer underflow in ccmp decrypt in src/ec encryption ccmp.c that subtracts the 8-byte CCMP trailer without checking minimum length. Attackers on a network whose WPA key is loaded can send a short crafted CCMP frame to overflow a stack buffer in the Ettercap...