PT-2009-1013 · Nlnet · Nsd

Nico Golde · Published 2009-05-22 · Updated 2009-05-29 · CVE-2009-1755

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions nsd versions 2.3.7 through 3.2.1

Description The issue is related to an off-by-one error in the packet read query section function in packet.c and process query section in query.c, which can lead to a denial of service (crash) and potentially allow the execution of arbitrary code via unspecified vectors that trigger a buffer overflow. Additionally, there are multiple vulnerabilities in the nsd package that can lead to disruption of protected information, and these vulnerabilities can be exploited remotely.

Recommendations For nsd version 2.3.7, consider disabling the process query section function in query.c as a temporary workaround until a patch is available. For nsd version 3.2.1, consider disabling the packet read query section function in packet.c as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-189

Related Identifiers

BDU:2015-02164

CVE-2009-1755

DSA-1803-1

Affected Products

Nsd

References · 11

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1755 · Security Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=529420 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-1755 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2009-1755 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-1755 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-02164 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-1755 · Security Note
• http://nlnetlabs.nl/publications/NSD_vulnerability_announcement.html · Vendor Advisory
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=529418 · Patch
• http://openwall.com/lists/oss-security/2009/05/19/1 · Note
• http://debian.org/security/dsa-1803 · Note