Description
If NSD is configured as secondary for a zone, the primary of that zone can crash NSD with an AXFR containing a DNS message with a special crafted SVCB RR with an rdata size of 65512, that let's an (uint16_t) variable that is used to allocate space needed for the RR wrap (because total size > 65535), causing a heap overflow. The attacker can perform a controlled (RCE class) head write of up to 65509 bytes
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
NLnet Labs NSD
Default version status: unaffected
4.14.0 to < 4.14.3affected