[NT] OllyDbg Format String Vulnerability ("INT3 AT")

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  OllyDbg Format String Vulnerability ("INT3 AT")
------------------------------------------------------------------------


SUMMARY

" <http://home.t-online.de/home/Ollydbg/> OllyDbg is a 32-bit assembler 
level analyzing debugger for Microsoft Windows. Emphasis on binary code 
analysis makes it particularly useful in cases where source is 
unavailable."

The vulnerability in OllyDbg allows attackers to place a formated string 
in the program being debugged that can cause the OllyDbg program to 
execute arbitrary code.

DETAILS

Vulnerable Systems:
 * OllyDbg version 1.10

Vulnerability takes place when module (with special crafted file name) 
executes int 3 instruction (trap to debugger).

Disassembler Snippets:
Here is the vulnerable code:

text:0042FBE0 lea eax, [ebp+buffer]
text:0042FBE6 push eax ; format string
text:0042FBE7 mov edx, [ebp+var_28]
text:0042FBEA push edx
text:0042FBEB call sub_42E100 ; _vsprintf->
;___vprinter

When format is an ASCII string like: "INT3 command at <module_name>.addr", 
Attacker can place a format string chars inside "<module_name>" (part of 
format buffer) and cause Olly to overwrite arbitrary data.

NOTE: Even with "IGNORE INT3 BREAKS" option checked, OllyDbg is still 
vulnerable. Attacker can also load some special crafted module (with 
special crafted name) while debugging, to make the attack more stealthy.


ADDITIONAL INFORMATION

The information has been provided by  <mailto:[email protected]> Piotr 
Bania.
The original article can be found at:  
<http://pb.specialised.info/all/adv/olly-int3-adv.txt> 
http://pb.specialised.info/all/adv/olly-int3-adv.txt



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.