NGS00016 Technical Advisory: Immunity Debugger Buffer Overflow Mar 22 2011 03:15PM
Research@NGSSecure (research ngssecure com)
Name: Immunity Debugger Buffer Overflow
Release Date: 22 March 2011
Reference: NGS00016
Discoverer: Paul Harrington
Vendor: Immunity Inc
Vendor Reference: Support #3171
Systems Affected: Windows
Risk: Low
Status: Fixed

Discovered: 28 October 2010
Released: 28 October 2010
Approved: 28 October 2010
Reported: 28 October 2010
Fixed: 6 December 2010
Published: 22 March 2011

Immunity Debugger V1.73 contains a buffer overflow vulnerability in its HTTP update mechanism

Technical Details
It is possible to spoof communications between the Immunity Debugger and its update servers at immunityinc.com.
By sending a specially crafted large HTTP reply it is possible to cause the Immunity Debugger to trigger the buffer overflow:

00487161 EB 02 JMP SHORT Immunity.00487165
00487163 8BD8 MOV EBX,EAX
00487165 8B83 2C060000 MOV EAX,DWORD PTR DS:[EBX+62C] <--- crash occurs here, EBX = 0x42424242
0048716B 85C0 TEST EAX,EAX

Care should be taken if using the Immunity Debugger as your JIT debugger not to get into a crash/debug/crash loop!
Various CPU Registers are overwritten, which could potentially result in remote code execution.

Fix Information
Immunity Inc has released an updated version of the debugger, which can be downloaded from the following URL:


NGS Secure Research


NGS Secure


Website: www.ngssecure.com<http://www.ngssecure.com>
Email: research (at) NGSSecure (dot) com [email concealed]<mailto:research (at) NGSSecure (dot) com [email concealed]>
[http://www.nccgroup.com/_client/images/global/NGS%20Secure.jpg] <http://www.ngssecure.com/>

This email is sent for and on behalf of NGS Secure Limited (Registered in England CRN: 04474600). The ultimate holding company is NCC Group plc (Registered in England CRN: 4627044). Registered Office: Manchester Technology Centre, Oxford Road, Manchester, M1 7EF

Confidentiality: This e-mail contains proprietary information, some or all of which may be confidential and/or legally privileged. It is for the intended recipient only. If an addressing or transmission error has misdirected this e-mail, please notify the author by replying to this e-mail and then delete the original. If you are not the intended recipient you may not use, disclose, distribute, copy, print or rely on any information contained in this e-mail. You must not inform any other person other than NCC Group or the sender of its existence.

For more information about NGS Secure please visit www.ngssecure.com<http://www.ngssecure.com>

P Before you print think about the ENVIRONMENT

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus