Summary – 22.03.2011
Name: Immunity Debugger Buffer Overflow
Release Date: 22 March 2011
Reference: NGS00016
Discoverer: Paul Harrington
Vendor: Immunity Inc
Vendor Reference: Support #3171
Systems Affected: Windows
Risk: Low
Status: Fixed
TimeLine
Discovered: 28 October 2010
Released: 28 October 2010
Approved: 28 October 2010
Reported: 28 October 2010
Fixed: 6 December 2010
Published: 22 March 2011
Description
Immunity Debugger V1.73 contains a buffer overflow vulnerability in its HTTP update mechanism
Technical Details
It is possible to spoof communications between the Immunity Debugger and its update servers at immunityinc.com.
By sending a specially crafted large HTTP reply it is possible to cause the Immunity Debugger to trigger the buffer overflow:
00487161 EB 02 JMP SHORT Immunity.00487165
00487163 8BD8 MOV EBX,EAX
00487165 8B83 2C060000 MOV EAX,DWORD PTR DS:[EBX+62C] <— crash occurs here, EBX = 0x42424242
0048716B 85C0 TEST EAX,EAX
Care should be taken if using the Immunity Debugger as your JIT debugger not to get into a crash/debug/crash loop!
Various CPU Registers are overwritten, which could potentially result in remote code execution.
Fix Information
