Immunity Debugger Buffer Overflow

Summary – 22.03.2011

Name: Immunity Debugger Buffer Overflow
Release Date: 22 March 2011
Reference: NGS00016
Discoverer: Paul Harrington
Vendor: Immunity Inc
Vendor Reference: Support #3171
Systems Affected: Windows
Risk: Low
Status: Fixed


Discovered: 28 October 2010
Released: 28 October 2010
Approved: 28 October 2010
Reported: 28 October 2010
Fixed:  6 December 2010
Published: 22 March 2011


Immunity Debugger V1.73 contains a  buffer overflow vulnerability in its HTTP update mechanism

Technical Details

It is possible to spoof communications between the Immunity Debugger and its update servers at
By sending a specially crafted large HTTP reply it is possible to cause the Immunity Debugger to trigger the buffer overflow:

00487161  EB 02           JMP SHORT Immunity.00487165
00487163  8BD8            MOV EBX,EAX
00487165  8B83 2C060000   MOV EAX,DWORD PTR DS:[EBX+62C]    <— crash occurs here, EBX = 0x42424242
0048716B  85C0            TEST EAX,EAX

Care should be taken if using the Immunity Debugger as your JIT debugger not to get into a crash/debug/crash loop!
Various CPU Registers are overwritten, which could potentially result in remote code execution.

Fix Information

Immunity Inc has released an updated version of the debugger, which can be downloaded from the following URL:


Call us before you need us.

Our experts will help you.

Get in touch