Ej people,

I couldn't find any reference to this subject on the site yet; so here it is ...
perhaps a little late, but on May 15 a new OllyDBG v1.10 vulnerability was found:

http://www.securiteam.com/windowsntfocus/5WP0B1FFPA.html

and the original article:

http://pb.specialised.info/all/adv/olly-int3-adv.txt


Quote:

Vulnerable Systems:
* OllyDbg version 1.10

Vulnerability takes place when module (with special crafted file name) executes int 3 instruction (trap to debugger).

Disassembler Snippets:
Here is the vulnerable code:

.text:0042FBE0 lea eax, [ebp+buffer]
.text:0042FBE6 push eax ; format string
.text:0042FBE7 mov edx, [ebp+var_28]
.text:0042FBEA push edx
.text:0042FBEB call sub_42E100 ; _vsprintf->
;___vprinter

When format is an ASCII string like: "INT3 command at <module_name>.addr", Attacker can place a format string chars inside "<module_name>" (part of format buffer) and cause Olly to overwrite arbitrary data.

NOTE: Even with "IGNORE INT3 BREAKS" option checked, OllyDbg is still vulnerable. Attacker can also load some special crafted module (with special crafted name) while debugging, to make the attack more stealthy.