NSD 'packet.c' Off-By-One Buffer Overflow Vulnerability

Bugtraq ID:	35029
Class:	Boundary Condition Error
CVE:	CVE-2009-1755
Remote:	Yes
Local:	No
Published:	May 19 2009 12:00AM
Updated:	May 07 2015 05:05PM
Credit:	Ilja van Sprundel of IOActive
Vulnerable:	NLnet Labs NSD 3.2.1 NLnet Labs NSD 2.3.7 NLnet Labs NSD 2.0 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:	NLnet Labs NSD 3.2.2

NSD 'packet.c' Off-By-One Buffer Overflow Vulnerability

NSD is prone to an off-by-one buffer-overflow vulnerability because the server fails to perform adequate boundary checks on user-supplied data.

Successfully exploiting this issue will allow attackers to execute arbitrary code within the context of the affected server. Failed exploit attempts will result in a denial-of-service condition.

Versions prior to NSD 3.2.2 are vulnerable.

NSD 'packet.c' Off-By-One Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

NSD 'packet.c' Off-By-One Buffer Overflow Vulnerability

Solution:
The vendor has released fixes. Please see the references for details.


Debian Linux 4.0 amd64

• Debian nsd_2.3.6-1+etch1_amd64.deb
  http://security.debian.org/pool/updates/main/n/nsd/nsd_2.3.6-1+etch1_a md64.deb

Debian Linux 4.0 ia-32

• Debian nsd_2.3.6-1+etch1_i386.deb
  http://security.debian.org/pool/updates/main/n/nsd/nsd_2.3.6-1+etch1_i 386.deb

Debian Linux 4.0 arm

• Debian nsd_2.3.6-1+etch1_arm.deb
  http://security.debian.org/pool/updates/main/n/nsd/nsd_2.3.6-1+etch1_a rm.deb

Debian Linux 5.0 hppa

• Debian nsd_2.3.7-1.1+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/n/nsd/nsd_2.3.7-1.1+lenny 1_hppa.deb


• Debian nsd3_3.0.7-3.lenny2_hppa.deb
  http://security.debian.org/pool/updates/main/n/nsd3/nsd3_3.0.7-3.lenny 2_hppa.deb

Debian Linux 5.0 ia-64

• Debian nsd_2.3.7-1.1+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/n/nsd/nsd_2.3.7-1.1+lenny 1_ia64.deb


• Debian nsd3_3.0.7-3.lenny2_ia64.deb
  http://security.debian.org/pool/updates/main/n/nsd3/nsd3_3.0.7-3.lenny 2_ia64.deb

Debian Linux 4.0 hppa

• Debian nsd_2.3.6-1+etch1_hppa.deb
  http://security.debian.org/pool/updates/main/n/nsd/nsd_2.3.6-1+etch1_h ppa.deb

Debian Linux 4.0 sparc

• Debian nsd_2.3.6-1+etch1_sparc.deb
  http://security.debian.org/pool/updates/main/n/nsd/nsd_2.3.6-1+etch1_s parc.deb

Debian Linux 4.0 s/390

• Debian nsd_2.3.6-1+etch1_s390.deb
  http://security.debian.org/pool/updates/main/n/nsd/nsd_2.3.6-1+etch1_s 390.deb

Debian Linux 5.0 arm

• Debian nsd_2.3.7-1.1+lenny1_arm.deb
  http://security.debian.org/pool/updates/main/n/nsd/nsd_2.3.7-1.1+lenny 1_arm.deb


• Debian nsd3_3.0.7-3.lenny2_arm.deb
  http://security.debian.org/pool/updates/main/n/nsd3/nsd3_3.0.7-3.lenny 2_arm.deb

Debian Linux 4.0 powerpc

• Debian nsd_2.3.6-1+etch1_powerpc.deb
  http://security.debian.org/pool/updates/main/n/nsd/nsd_2.3.6-1+etch1_p owerpc.deb

Debian Linux 4.0 alpha

• Debian nsd_2.3.6-1+etch1_alpha.deb
  http://security.debian.org/pool/updates/main/n/nsd/nsd_2.3.6-1+etch1_a lpha.deb

Debian Linux 5.0 armel

• Debian nsd_2.3.7-1.1+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/n/nsd/nsd_2.3.7-1.1+lenny 1_armel.deb


• Debian nsd3_3.0.7-3.lenny2_armel.deb
  http://security.debian.org/pool/updates/main/n/nsd3/nsd3_3.0.7-3.lenny 2_armel.deb

Debian Linux 4.0 mipsel

• Debian nsd_2.3.6-1+etch1_mipsel.deb
  http://security.debian.org/pool/updates/main/n/nsd/nsd_2.3.6-1+etch1_m ipsel.deb

Debian Linux 5.0 amd64

• Debian nsd_2.3.7-1.1+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/n/nsd/nsd_2.3.7-1.1+lenny 1_amd64.deb


• Debian nsd3_3.0.7-3.lenny2_amd64.deb
  http://security.debian.org/pool/updates/main/n/nsd3/nsd3_3.0.7-3.lenny 2_amd64.deb

Debian Linux 5.0 alpha

• Debian nsd_2.3.7-1.1+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/n/nsd/nsd_2.3.7-1.1+lenny 1_alpha.deb


• Debian nsd3_3.0.7-3.lenny2_alpha.deb
  http://security.debian.org/pool/updates/main/n/nsd3/nsd3_3.0.7-3.lenny 2_alpha.deb

Debian Linux 5.0 ia-32

• Debian nsd_2.3.7-1.1+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/n/nsd/nsd_2.3.7-1.1+lenny 1_i386.deb


• Debian nsd3_3.0.7-3.lenny2_i386.deb
  http://security.debian.org/pool/updates/main/n/nsd3/nsd3_3.0.7-3.lenny 2_i386.deb

Debian Linux 5.0 mips

• Debian nsd_2.3.7-1.1+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/n/nsd/nsd_2.3.7-1.1+lenny 1_mips.deb


• Debian nsd3_3.0.7-3.lenny2_mips.deb
  http://security.debian.org/pool/updates/main/n/nsd3/nsd3_3.0.7-3.lenny 2_mips.deb

Debian Linux 5.0 s/390

• Debian nsd_2.3.7-1.1+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/n/nsd/nsd_2.3.7-1.1+lenny 1_s390.deb


• Debian nsd3_3.0.7-3.lenny2_s390.deb
  http://security.debian.org/pool/updates/main/n/nsd3/nsd3_3.0.7-3.lenny 2_s390.deb

Debian Linux 5.0 mipsel

• Debian nsd_2.3.7-1.1+lenny1_mipsel.deb
  http://security.debian.org/pool/updates/main/n/nsd/nsd_2.3.7-1.1+lenny 1_mipsel.deb


• Debian nsd3_3.0.7-3.lenny2_mipsel.deb
  http://security.debian.org/pool/updates/main/n/nsd3/nsd3_3.0.7-3.lenny 2_mipsel.deb

Debian Linux 5.0 powerpc

• Debian nsd_2.3.7-1.1+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/n/nsd/nsd_2.3.7-1.1+lenny 1_powerpc.deb


• Debian nsd3_3.0.7-3.lenny2_powerpc.deb
  http://security.debian.org/pool/updates/main/n/nsd3/nsd3_3.0.7-3.lenny 2_powerpc.deb

Debian Linux 4.0 ia-64

• Debian nsd_2.3.6-1+etch1_ia64.deb
  http://security.debian.org/pool/updates/main/n/nsd/nsd_2.3.6-1+etch1_i a64.deb

Debian Linux 4.0 mips

• Debian nsd_2.3.6-1+etch1_mips.deb
  http://security.debian.org/pool/updates/main/n/nsd/nsd_2.3.6-1+etch1_m ips.deb

Debian Linux 5.0 sparc

• Debian nsd_2.3.7-1.1+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/n/nsd/nsd_2.3.7-1.1+lenny 1_sparc.deb


• Debian nsd3_3.0.7-3.lenny2_sparc.deb
  http://security.debian.org/pool/updates/main/n/nsd3/nsd3_3.0.7-3.lenny 2_sparc.deb

NLnet Labs NSD 2.0

• NLnet Labs nsd-3.2.2.tar.gz
  http://www.nlnetlabs.nl/downloads/nsd/nsd-3.2.2.tar.gz

NLnet Labs NSD 2.3.7

• NLnet Labs nsd-3.2.2.tar.gz
  http://www.nlnetlabs.nl/downloads/nsd/nsd-3.2.2.tar.gz

NLnet Labs NSD 3.2.1

• NLnet Labs nsd-3.2.2.tar.gz
  http://www.nlnetlabs.nl/downloads/nsd/nsd-3.2.2.tar.gz

NSD 'packet.c' Off-By-One Buffer Overflow Vulnerability

References:

• Critical off-by-one error in NSD2 (Ondrej Sury)
  
• Critical off-by-one error in NSD3 (Ondrej Sury)
  
• NSD Homepage (NLnet Labs)
  
• NSD Vulnerability Announcement (NLnet Labs)
  
• Vulnerability Note VU#710316 NSD vulnerable to one-byte overflow (US-CERT)