Name: Immunity Debugger Buffer Overflow
Release Date: 22 March 2011
Reference: NGS00016
Discoverer: Paul Harrington
Vendor: Immunity Inc
Vendor Reference: Support #3171
Systems Affected: Windows
Risk: Low
Status: Fixed
Discovered: 28 October 2010
Released: 28 October 2010
Approved: 28 October 2010
Reported: 28 October 2010
Fixed: 6 December 2010
Published: 22 March 2011
Immunity Debugger V1.73 contains a buffer overflow vulnerability in its HTTP update mechanism
It is possible to spoof communications between the Immunity Debugger and its update servers at immunityinc.com.
By sending a specially crafted large HTTP reply it is possible to cause the Immunity Debugger to trigger the buffer overflow:
00487161 EB 02 JMP SHORT Immunity.00487165
00487163 8BD8 MOV EBX,EAX
00487165 8B83 2C060000 MOV EAX,DWORD PTR DS:[EBX+62C] <— crash occurs here, EBX = 0x42424242
0048716B 85C0 TEST EAX,EAX
Care should be taken if using the Immunity Debugger as your JIT debugger not to get into a crash/debug/crash loop!
Various CPU Registers are overwritten, which could potentially result in remote code execution.
Immunity Inc has released an updated version of the debugger, which can be downloaded from the following URL:
http://debugger.immunityinc.com/
NGS Secure Research
http://www.ngssecure.com
Research@NGSSecure
NGS Secure
,
Telephone:
Mobile:
Fax:
Website: www.ngssecure.com<http://www.ngssecure.com>
Email: [email protected]<mailto:[email protected]>
[http://www.nccgroup.com/_client/images/global/NGS%20Secure.jpg] <http://www.ngssecure.com/>
This email is sent for and on behalf of NGS Secure Limited (Registered in England CRN: 04474600). The ultimate holding company is NCC Group plc (Registered in
England CRN: 4627044). Registered Office: Manchester Technology Centre, Oxford Road, Manchester, M1 7EF
Confidentiality: This e-mail contains proprietary information, some or all of which may be confidential and/or legally privileged. It is for the intended recipient
only. If an addressing or transmission error has misdirected this e-mail, please notify the author by replying to this e-mail and then delete the original. If you
are not the intended recipient you may not use, disclose, distribute, copy, print or rely on any information contained in this e-mail. You must not inform any other
person other than NCC Group or the sender of its existence.
For more information about NGS Secure please visit www.ngssecure.com<http://www.ngssecure.com>
P Before you print think about the ENVIRONMENT