Summary – 22.03.2011
Name: Immunity Debugger Buffer Overflow
Release Date: 22 March 2011
Reference: NGS00016
Discoverer: Paul Harrington
Vendor: Immunity Inc
Vendor Reference: Support #3171
Systems Affected: Windows
Risk: Low
Status: Fixed
TimeLine
Discovered: 28 October 2010
Released: 28 October 2010
Approved: 28 October 2010
Reported: 28 October 2010
Fixed: 6 December 2010
Published: 22 March 2011
Description
Immunity Debugger V1.73 contains a buffer overflow vulnerability in its HTTP update mechanism
Technical Details
It is possible to spoof communications between the Immunity Debugger and its update servers at immunityinc.com.
By sending a specially crafted large HTTP reply it is possible to cause the Immunity Debugger to trigger the buffer overflow:
00487161 EB 02 JMP SHORT Immunity.00487165
00487163 8BD8 MOV EBX,EAX
00487165 8B83 2C060000 MOV EAX,DWORD PTR DS:[EBX+62C] <— crash occurs here, EBX = 0x42424242
0048716B 85C0 TEST EAX,EAX
Care should be taken if using the Immunity Debugger as your JIT debugger not to get into a crash/debug/crash loop!
Various CPU Registers are overwritten, which could potentially result in remote code execution.
Fix Information
Immunity Inc has released an updated version of the debugger, which can be downloaded from the following URL:
http://debugger.immunityinc.com/
