The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
OllyDbg Format String Vulnerability ("INT3 AT")
------------------------------------------------------------------------
SUMMARY
" <http://home.t-online.de/home/Ollydbg/> OllyDbg is a 32-bit assembler
level analyzing debugger for Microsoft Windows. Emphasis on binary code
analysis makes it particularly useful in cases where source is
unavailable."
The vulnerability in OllyDbg allows attackers to place a formated string
in the program being debugged that can cause the OllyDbg program to
execute arbitrary code.
DETAILS
Vulnerable Systems:
* OllyDbg version 1.10
Vulnerability takes place when module (with special crafted file name)
executes int 3 instruction (trap to debugger).
Disassembler Snippets:
Here is the vulnerable code:
text:0042FBE0 lea eax, [ebp+buffer]
text:0042FBE6 push eax ; format string
text:0042FBE7 mov edx, [ebp+var_28]
text:0042FBEA push edx
text:0042FBEB call sub_42E100 ; _vsprintf->
;___vprinter
When format is an ASCII string like: "INT3 command at <module_name>.addr",
Attacker can place a format string chars inside "<module_name>" (part of
format buffer) and cause Olly to overwrite arbitrary data.
NOTE: Even with "IGNORE INT3 BREAKS" option checked, OllyDbg is still
vulnerable. Attacker can also load some special crafted module (with
special crafted name) while debugging, to make the attack more stealthy.
ADDITIONAL INFORMATION
The information has been provided by <mailto:bania.piotr@gmail.com> Piotr
Bania.
The original article can be found at:
<http://pb.specialised.info/all/adv/olly-int3-adv.txt>
http://pb.specialised.info/all/adv/olly-int3-adv.txt
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
