bugtraq - NGS00016 Technical Advisory: Immunity Debugger Buffer Overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <7E45577E4E72EC42BB3F8560D57E75511CDC1A@manexchprd01>
Date: Tue, 22 Mar 2011 15:15:46 +0000
From: "Research@...Secure" <research@...secure.com>
To: "bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>
Subject: NGS00016 Technical Advisory: Immunity Debugger Buffer Overflow

=======
Summary
=======
Name: Immunity Debugger Buffer Overflow
Release Date: 22 March 2011
Reference: NGS00016
Discoverer: Paul Harrington
Vendor: Immunity Inc
Vendor Reference: Support #3171
Systems Affected: Windows
Risk: Low
Status: Fixed

========
TimeLine
========
Discovered: 28 October 2010
Released: 28 October 2010
Approved: 28 October 2010
Reported: 28 October 2010
Fixed:  6 December 2010
Published: 22 March 2011

===========
Description
===========
Immunity Debugger V1.73 contains a  buffer overflow vulnerability in its HTTP update mechanism

=================
Technical Details
=================
It is possible to spoof communications between the Immunity Debugger and its update servers at immunityinc.com.
By sending a specially crafted large HTTP reply it is possible to cause the Immunity Debugger to trigger the buffer overflow:

00487161  EB 02           JMP SHORT Immunity.00487165
00487163  8BD8            MOV EBX,EAX
00487165  8B83 2C060000   MOV EAX,DWORD PTR DS:[EBX+62C]    <--- crash occurs here, EBX = 0x42424242
0048716B  85C0            TEST EAX,EAX

Care should be taken if using the Immunity Debugger as your JIT debugger not to get into a crash/debug/crash loop!
Various CPU Registers are overwritten, which could potentially result in remote code execution.

===============
Fix Information
===============
Immunity Inc has released an updated version of the debugger, which can be downloaded from the following URL:

http://debugger.immunityinc.com/

NGS Secure Research
http://www.ngssecure.com
________________________________

Research@...Secure

NGS Secure

,

Telephone:
Mobile:
Fax:
Website: www.ngssecure.com<http://www.ngssecure.com>
Email:  research@...Secure.com<mailto:research@...Secure.com>
        [http://www.nccgroup.com/_client/images/global/NGS%20Secure.jpg]  <http://www.ngssecure.com/>
________________________________

This email is sent for and on behalf of NGS Secure Limited (Registered in England CRN: 04474600). The ultimate holding company is NCC Group plc (Registered in England CRN: 4627044). Registered Office: Manchester Technology Centre, Oxford Road, Manchester, M1 7EF

Confidentiality: This e-mail contains proprietary information, some or all of which may be confidential and/or legally privileged. It is for the intended recipient only. If an addressing or transmission error has misdirected this e-mail, please notify the author by replying to this e-mail and then delete the original. If you are not the intended recipient you may not use, disclose, distribute, copy, print or rely on any information contained in this e-mail. You must not inform any other person other than NCC Group or the sender of its existence.

For more information about NGS Secure please visit www.ngssecure.com<http://www.ngssecure.com>

P Before you print think about the ENVIRONMENT