Date: Mon, 31 Jan 2005 00:07:29 +0000
From: dila <dilabox@...il.com>
To: bugtraq@...urityfocus.com, vulnwatch@...nwatch.org
Subject: Re: iDEFENSE Security Advisory 01.24.05: DataRescue Interactive Disassembler Pro Buffer Overflow Vulnerability


A fixed version of PEiD has been released.
http://peid.tk/

On Mon, 24 Jan 2005 15:13:39 -0500, iDefense Customer Service
<customerservice@...fense.com> wrote:
> DataRescue Interactive Disassembler Pro Buffer Overflow Vulnerability
> 
> iDEFENSE Security Advisory 01.24.05
> www.idefense.com/application/poi/display?id=189&type=vulnerabilities
> January 24, 2005
> 
> I. BACKGROUND
> 
> DataRescue Inc.'s IDA Pro is a Windows or Linux hosted multi-processor
> disassembler and debugger providing a multitude of features. More
> information is available at:
> 
>     http://www.datarescue.com/idabase/
> 
> II. DESCRIPTION
> 
> Exploitation of a buffer overflow vulnerability in DataRescue Inc.'s
> Interactive Disassembler Pro (IDA Pro) allows attackers to execute
> arbitrary code under the context of the logged on user.
> 
> The problem specifically exists in the code responsible for parsing the
> Portable Executable import directory. The import directory lists all the
> symbols imported by the PE file and is stored as an array of data
> structures. Each data structure contains the name of the imported
> library and a list of function pointers, known as the Import Address
> Table. A stack-based buffer overflow occurs when parsing long import
> library names in the following snippet of assembly from ida.wll
> (IDA Pro v4.7):
> 
>     0x100838BB LEA EDX, [EBP-30C]
>     0x100838C1 PUSH DWORD PTR [EBP+8]
>     0x100838C4 PUSH EDX
>     0x100838C5 CALL ida.#835
> 
> "EBP+8" from above represents the attacker-supplied source buffer and
> "EBP-30C" represents the static stack-based destination buffer of
> approximately 800 bytes. The "ida_835" procedure performs an unchecked
> string copy overwriting a stored return address and allowing an attacker
> to redirect CPU flow to eventually execute arbitrary code.
> 
> III. ANALYSIS
> 
> Exploitation of the described vulnerability allows attackers to execute
> arbitrary code under the context of the logged in user. Exploitation
> requires that an attacker convince a target user to open a malicious
> Portable Executable file with a vulnerable version of IDA Pro. IDA Pro
> is the primary disassembler used by many security researchers. As such,
> the severity of this issue is exacerbated when considering the impact of
> a fast spreading worm combined with an exploit for this vulnerability.
> 
> Although simple modification of an import library name is sufficient to
> exploit this vulnerability, the Windows loader will fail to recognize it
> as a valid PE file. This will result in a non-executable malicious
> binary. iDEFENSE has discovered a method for exploiting this
> vulnerability in a fashion that is undetectable via PE import table
> entry analysis, and that is affective against IDA Pro and will load and
> execute as a regular binary without error.
> 
> It should be noted that other applications designed to analyze PE
> executables may also be vulnerable. PEiD is a freely available PE
> analysis tool and is also susceptible to attack.
> 
> IV. DETECTION
> 
> iDEFENSE has confirmed the existence of this vulnerability in IDA Pro
> versions 4.6 Service Pack 1 and 4.7 on both the Microsoft Windows and
> Linux platforms. It is suspected that earlier versions are also
> affected.
> 
> V. WORKAROUND
> 
> Prior to opening unknown files with vulnerable versions of IDA Pro,
> examine the PE import table entries for long or abnormal strings. There
> are a number of tools available for analyzing the PE file format. It is
> important to note that this method will not catch all exploit vectors.
> 
> VI. VENDOR RESPONSE
> 
> "A temporary fix is available here
> 
>    http://www.datarescue.com/cgi-local/ultimatebb.cgi?/forum/2.html
> 
> A more generic fix will be available in the next IDA Pro release."
> 
> VII. CVE INFORMATION
> 
> The Common Vulnerabilities and Exposures (CVE) project has assigned the
> names CAN-2005-0115 to these issues. This is a candidate for inclusion
> in the CVE list (http://cve.mitre.org), which standardizes names for
> security problems.
> 
> VIII. DISCLOSURE TIMELINE
> 
> 01/12/2005      Initial vendor notification
> 01/12/2005      Initial vendor response
> 01/24/2005      Coordinated public disclosure
> 
> IX. CREDIT
> 
> Lord Yup is credited with this discovery.
> 
> Get paid for vulnerability research
> http://www.idefense.com/poi/teams/vcp.jsp
> 
> X. LEGAL NOTICES
> 
> Copyright (c) 2005 iDEFENSE, Inc.
> 
> Permission is granted for the redistribution of this alert
> electronically. It may not be edited in any way without the express
> written consent of iDEFENSE. If you wish to reprint the whole or any
> part of this alert in any other medium other than electronically, please
> email customerservice@...fense.com for permission.
> 
> Disclaimer: The information in the advisory is believed to be accurate
> at the time of publishing based on currently available information. Use
> of the information constitutes acceptance for use in an AS IS condition.
> 
> There are no warranties with regard to this information. Neither the
> author nor the publisher accepts any liability for any direct, indirect,
> or consequential loss or damage arising from use of, or reliance on,
> this information.
>

Powered by blists - more mailing lists