[NT] OllyDbg Format String Vulnerability ("INT3 AT")

From: SecuriTeam (support_at_securiteam.com)
Date: 05/15/05

  • Next message: SecuriTeam: "[EXPL] gzip Directory Traversal Vulnerability ("gunzip -N")" 
    To: list@securiteam.com
Date: 15 May 2005 15:45:24 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      OllyDbg Format String Vulnerability ("INT3 AT")
    ------------------------------------------------------------------------

    SUMMARY

    " <http://home.t-online.de/home/Ollydbg/> OllyDbg is a 32-bit assembler
    level analyzing debugger for Microsoft Windows. Emphasis on binary code
    analysis makes it particularly useful in cases where source is
    unavailable."

    The vulnerability in OllyDbg allows attackers to place a formated string
    in the program being debugged that can cause the OllyDbg program to
    execute arbitrary code.

    DETAILS

    Vulnerable Systems:
     * OllyDbg version 1.10

    Vulnerability takes place when module (with special crafted file name)
    executes int 3 instruction (trap to debugger).

    Disassembler Snippets:
    Here is the vulnerable code:

    text:0042FBE0 lea eax, [ebp+buffer]
    text:0042FBE6 push eax ; format string
    text:0042FBE7 mov edx, [ebp+var_28]
    text:0042FBEA push edx
    text:0042FBEB call sub_42E100 ; _vsprintf->
    ;___vprinter

    When format is an ASCII string like: "INT3 command at <module_name>.addr",
    Attacker can place a format string chars inside "<module_name>" (part of
    format buffer) and cause Olly to overwrite arbitrary data.

    NOTE: Even with "IGNORE INT3 BREAKS" option checked, OllyDbg is still
    vulnerable. Attacker can also load some special crafted module (with
    special crafted name) while debugging, to make the attack more stealthy.

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:bania.piotr@gmail.com> Piotr
    Bania.
    The original article can be found at:
    <http://pb.specialised.info/all/adv/olly-int3-adv.txt>
    http://pb.specialised.info/all/adv/olly-int3-adv.txt

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[EXPL] gzip Directory Traversal Vulnerability ("gunzip -N")"

    Relevant Pages

    • [NEWS] @Mail Web Interface Multiple Security Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... attacker to point it to mailbox of any registered user in @Mail system. ... Vulnerability 2: SQL database install - Multiple SQL Injection ...
      (Securiteam)
    • [NT] EMC Legato Networker DoS and Multiple Buffer Overflows
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... EMC Legato Networker DoS and Multiple Buffer Overflows ... The vulnerability specifically exists due to improper handling of ... is sent by an attacker, it is possible to overwrite portions of heap ...
      (Securiteam)
    • [UNIX] IBM Informix Dynamic Server DBLANG Directory Traversal Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... IBM Informix Dynamic Server DBLANG Directory Traversal Vulnerability ... Local exploitation of a directory traversal vulnerability in IBM Corp.'s ... attacker can cause set-uid binaries to use Native Language Support ...
      (Securiteam)
    • [NEWS] IBM Lotus Domino IMAP Buffer Overflow Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... IBM Lotus Domino IMAP Buffer Overflow Vulnerability ... Remote exploitation of a buffer overflow vulnerability within IBM Corp.'s ... This allows an attacker to take complete control of the compromised ...
      (Securiteam)
    • [UNIX] Apache MyFaces Tomahawk JSF Framework Cross-Site Scripting (XSS)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Apache MyFaces Tomahawk JSF Framework Cross-Site Scripting (XSS) ... Remote exploitation of an input validation vulnerability ... an attacker to perform a cross-site scripting attack. ...
      (Securiteam)