[NEWS] DataRescue Interactive Disassembler Pro Buffer Overflow Vulnerability

From: SecuriTeam (support_at_securiteam.com)
Date: 01/25/05

  • Next message: SecuriTeam: "[NEWS] Multi Vendor fd_set Structure Bitmap Array Index Overflow" 
    To: list@securiteam.com
Date: 25 Jan 2005 18:53:03 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      DataRescue Interactive Disassembler Pro Buffer Overflow Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

     <http://www.datarescue.com/idabase/> DataRescue Inc.'s IDA Pro is "a
    Windows or Linux hosted multi-processor disassembler and debugger
    providing a multitude of features".

    Exploitation of a buffer overflow vulnerability in DataRescue Inc.'s
    Interactive Disassembler Pro (IDA Pro) allows attackers to execute
    arbitrary code under the context of the logged on user.

    DETAILS

    Vulnerable Systems:
     * IDA Pro version 4.6 Service Pack 1
     * IDA Pro version 4.7

    The problem specifically exists in the code responsible for parsing the
    Portable Executable import directory. The import directory lists all the
    symbols imported by the PE file and is stored as an array of data
    structures. Each data structure contains the name of the imported library
    and a list of function pointers, known as the Import Address Table. A
    stack-based buffer overflow occurs when parsing long import library names
    in the following snippet of assembly from ida.wll (IDA Pro v4.7):

        0x100838BB LEA EDX, [EBP-30C]
        0x100838C1 PUSH DWORD PTR [EBP+8]
        0x100838C4 PUSH EDX
        0x100838C5 CALL ida.#835

    "EBP+8" from above represents the attacker-supplied source buffer and
    "EBP-30C" represents the static stack-based destination buffer of
    approximately 800 bytes. The "ida_835" procedure performs an unchecked
    string copy overwriting a stored return address and allowing an attacker
    to redirect CPU flow to eventually execute arbitrary code.

    Analysis:
    Exploitation of the described vulnerability allows attackers to execute
    arbitrary code under the context of the logged in user. Exploitation
    requires that an attacker convince a target user to open a malicious
    Portable Executable file with a vulnerable version of IDA Pro. IDA Pro is
    the primary disassembler used by many security researchers. As such, the
    severity of this issue is exacerbated when considering the impact of a
    fast spreading worm combined with an exploit for this vulnerability.

    Although simple modification of an import library name is sufficient to
    exploit this vulnerability, the Windows loader will fail to recognize it
    as a valid PE file. This will result in a non-executable malicious binary.
    iDEFENSE has discovered a method for exploiting this vulnerability in a
    fashion that is undetectable via PE import table entry analysis, and that
    is affective against IDA Pro and will load and execute as a regular binary
    without error.

    It should be noted that other applications designed to analyze PE
    executables may also be vulnerable. PEiD is a freely available PE analysis
    tool and is also susceptible to attack.

    Workaround:
    Prior to opening unknown files with vulnerable versions of IDA Pro,
    examine the PE import table entries for long or abnormal strings. There
    are a number of tools available for analyzing the PE file format. It is
    important to note that this method will not catch all exploit vectors.

    Vendor response:
    "A temporary fix is available here
    <http://www.datarescue.com/cgi-local/ultimatebb.cgi?/forum/2.html>
    http://www.datarescue.com/cgi-local/ultimatebb.cgi?/forum/2.html

    A more generic fix will be available in the next IDA Pro release."

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0115>
    CAN-2005-0115

    Disclosure Timeline:
    01/12/2005 - Initial vendor notification
    01/12/2005 - Initial vendor response
    01/24/2005 - Coordinated public disclosure

    ADDITIONAL INFORMATION

    The information has been provided by
    <mailto:customerservice@idefense.com> iDefense Customer Service.
    The original article can be found at:
    <http://www.idefense.com/application/poi/display?id=189&type=vulnerabilities> http://www.idefense.com/application/poi/display?id=189&type=vulnerabilities

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[NEWS] Multi Vendor fd_set Structure Bitmap Array Index Overflow"

    Relevant Pages

    • [NT] Windows Kernel APC Data-Free Local Privilege Escalation (MS05-055)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Windows Kernel APC Data-Free Local Privilege Escalation ... vulnerability in the Windows kernel that could allow any code executing on ... contains an APC queued by a now-terminated external process in its lists, ...
      (Securiteam)
    • [UNIX] Mpg123 Remote Client-Side Heap Corruption (Exploit, readstring())
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... unsigned int p_requestaddr; ... void printe; ... lists the platforms in a loop. ...
      (Securiteam)
    • [UNIX] Apache mod_negotiation XSS and Http Response Splitting
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Apache mod_negotiation XSS and Http Response Splitting ... * A type map which explicitly lists ... sanitized, in the response header, it could result in a Http Response ...
      (Securiteam)
    • [NT] McAfee FreeScan ActiveX Buffer Overflow and Information Disclosure
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... award-winning McAfee VirusScan engine, FreeScan searches for viruses, ... The code below lists about 25 different parameters which the ... '&H0017=all users/start menu/programs ...
      (Securiteam)
    • [TOOL] Travesty - Network Hardware Addresses Manager
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... It also allows the user to import their own lists of hardware addresses ... and descriptions that can be navigated from within the Travesty interface. ... system that is currently down on a DHCP network. ...
      (Securiteam)