[NEWS] DataRescue Interactive Disassembler Pro Buffer Overflow Vulnerability
From: SecuriTeam (support_at_securiteam.com)
To: firstname.lastname@example.org Date: 25 Jan 2005 18:53:03 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
- - - - - - - - -
DataRescue Interactive Disassembler Pro Buffer Overflow Vulnerability
<http://www.datarescue.com/idabase/> DataRescue Inc.'s IDA Pro is "a
Windows or Linux hosted multi-processor disassembler and debugger
providing a multitude of features".
Exploitation of a buffer overflow vulnerability in DataRescue Inc.'s
Interactive Disassembler Pro (IDA Pro) allows attackers to execute
arbitrary code under the context of the logged on user.
* IDA Pro version 4.6 Service Pack 1
* IDA Pro version 4.7
The problem specifically exists in the code responsible for parsing the
Portable Executable import directory. The import directory lists all the
symbols imported by the PE file and is stored as an array of data
structures. Each data structure contains the name of the imported library
and a list of function pointers, known as the Import Address Table. A
stack-based buffer overflow occurs when parsing long import library names
in the following snippet of assembly from ida.wll (IDA Pro v4.7):
0x100838BB LEA EDX, [EBP-30C]
0x100838C1 PUSH DWORD PTR [EBP+8]
0x100838C4 PUSH EDX
0x100838C5 CALL ida.#835
"EBP+8" from above represents the attacker-supplied source buffer and
"EBP-30C" represents the static stack-based destination buffer of
approximately 800 bytes. The "ida_835" procedure performs an unchecked
string copy overwriting a stored return address and allowing an attacker
to redirect CPU flow to eventually execute arbitrary code.
Exploitation of the described vulnerability allows attackers to execute
arbitrary code under the context of the logged in user. Exploitation
requires that an attacker convince a target user to open a malicious
Portable Executable file with a vulnerable version of IDA Pro. IDA Pro is
the primary disassembler used by many security researchers. As such, the
severity of this issue is exacerbated when considering the impact of a
fast spreading worm combined with an exploit for this vulnerability.
Although simple modification of an import library name is sufficient to
exploit this vulnerability, the Windows loader will fail to recognize it
as a valid PE file. This will result in a non-executable malicious binary.
iDEFENSE has discovered a method for exploiting this vulnerability in a
fashion that is undetectable via PE import table entry analysis, and that
is affective against IDA Pro and will load and execute as a regular binary
It should be noted that other applications designed to analyze PE
executables may also be vulnerable. PEiD is a freely available PE analysis
tool and is also susceptible to attack.
Prior to opening unknown files with vulnerable versions of IDA Pro,
examine the PE import table entries for long or abnormal strings. There
are a number of tools available for analyzing the PE file format. It is
important to note that this method will not catch all exploit vectors.
"A temporary fix is available here
A more generic fix will be available in the next IDA Pro release."
01/12/2005 - Initial vendor notification
01/12/2005 - Initial vendor response
01/24/2005 - Coordinated public disclosure
The information has been provided by
<mailto:email@example.com> iDefense Customer Service.
The original article can be found at:
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: firstname.lastname@example.org
In order to subscribe to the mailing list, simply forward this email to: email@example.com
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.