======= Summary ======= Name: Immunity Debugger Buffer Overflow Release Date: 22 March 2011 Reference: NGS00016 Discoverer: Paul Harrington Vendor: Immunity Inc Vendor Reference: Support #3171 Systems Affected: Windows Risk: Low Status: Fixed ======== TimeLine ======== Discovered: 28 October 2010 Released: 28 October 2010 Approved: 28 October 2010 Reported: 28 October 2010 Fixed: 6 December 2010 Published: 22 March 2011 =========== Description =========== Immunity Debugger V1.73 contains a buffer overflow vulnerability in its HTTP update mechanism ================= Technical Details ================= It is possible to spoof communications between the Immunity Debugger and its update servers at immunityinc.com. By sending a specially crafted large HTTP reply it is possible to cause the Immunity Debugger to trigger the buffer overflow: 00487161 EB 02 JMP SHORT Immunity.00487165 00487163 8BD8 MOV EBX,EAX 00487165 8B83 2C060000 MOV EAX,DWORD PTR DS:[EBX+62C] <--- crash occurs here, EBX = 0x42424242 0048716B 85C0 TEST EAX,EAX Care should be taken if using the Immunity Debugger as your JIT debugger not to get into a crash/debug/crash loop! Various CPU Registers are overwritten, which could potentially result in remote code execution. =============== Fix Information =============== Immunity Inc has released an updated version of the debugger, which can be downloaded from the following URL: http://debugger.immunityinc.com/ NGS Secure Research http://www.ngssecure.com ________________________________ Research@NGSSecure NGS Secure , Telephone: Mobile: Fax: Website: www.ngssecure.com<http://www.ngssecure.com> Email: research@xxxxxxxxxxxxx<mailto:research@xxxxxxxxxxxxx> [http://www.nccgroup.com/_client/images/global/NGS%20Secure.jpg] <http://www.ngssecure.com/> ________________________________ This email is sent for and on behalf of NGS Secure Limited (Registered in England CRN: 04474600). The ultimate holding company is NCC Group plc (Registered in England CRN: 4627044). Registered Office: Manchester Technology Centre, Oxford Road, Manchester, M1 7EF Confidentiality: This e-mail contains proprietary information, some or all of which may be confidential and/or legally privileged. It is for the intended recipient only. If an addressing or transmission error has misdirected this e-mail, please notify the author by replying to this e-mail and then delete the original. If you are not the intended recipient you may not use, disclose, distribute, copy, print or rely on any information contained in this e-mail. You must not inform any other person other than NCC Group or the sender of its existence. For more information about NGS Secure please visit www.ngssecure.com<http://www.ngssecure.com> P Before you print think about the ENVIRONMENT
