query.c in NSD 3.0.x through 3.0.8, 3.1.x through 3.1.1, and 3.2.x before 3.2.12 allows remote attackers to cause a denial of service (NULL pointer dereference and child process crash) via a crafted DNS packet.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - query.c in NSD 3.0.x through 3.0.8, 3.1.x through 3.1.1, and 3.2.x before 3.2.12 allows remote attackers
    to cause a denial of service (NULL pointer dereference and child process crash) via a crafted DNS packet.
    (CVE-2012-2978)

Updated upstream releasee for CVE-2012-2979 / VU#517036, our packages were not vulnerable Fix for CVE-2012-2978: NSD denial of service vulnerability from non-standard DNS packet from any host

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the version of NSD running on the remote host is affected by a denial of service vulnerability because it fails to properly handle specially crafted DNS packets.  This issue occurs because of a NULL pointer dereference error in the 'query.c' source file.

Note that Nessus has only relied on the version itself and has not attempted to determine whether the patches have been applied.

Fix for CVE-2012-2978: NSD denial of service vulnerability from non-standard DNS packet from any host

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Marek Vavrusa and Lubos Slovak report :

It is possible to crash (SIGSEGV) a NSD child server process by sending it a non-standard DNS packet from any host on the internet. A crashed child process will automatically be restarted by the parent process, but an attacker may keep the NSD server occupied restarting child processes by sending it a stream of such packets effectively preventing the NSD server to serve.

Marek Vavrusa and Lubos Slovak discovered that NSD, an authoritative domain name server, is not properly handling non-standard DNS packets.
This can result in a NULL pointer dereference and crash the handling process. A remote attacker can abuse this flaw to perform denial of service attacks.

ID	Name	Product	Family	Type	Severity
401334	Alpine: multiple nsd packages: security update to 3.2.10-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	high
401334	Alpine: multiple nsd packages: security update to 3.2.10-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	high
61470	Fedora 16 : nsd-3.2.13-1.fc16 (2012-11207)	Nessus	Fedora Local Security Checks	Local	medium
61469	Fedora 17 : nsd-3.2.13-1.fc17 (2012-11203)	Nessus	Fedora Local Security Checks	Local	medium
60153	NSD query_add_optional() Function NULL Pointer Dereference Malformed DNS Packet Parsing Remote DoS	Nessus	DNS	Remote	medium
60145	Fedora 17 : nsd-3.2.12-1.fc17 (2012-10893)	Nessus	Fedora Local Security Checks	Local	medium
60143	Fedora 16 : nsd-3.2.12-1.fc16 (2012-10887)	Nessus	Fedora Local Security Checks	Local	medium
60089	FreeBSD : dns/nsd -- DoS vulnerability from non-standard DNS packet (ce82bfeb-d276-11e1-92c6-14dae938ec40)	Nessus	FreeBSD Local Security Checks	Local	medium
60068	Debian DSA-2515-1 : nsd3 - NULL pointer dereference	Nessus	Debian Local Security Checks	Local	medium

Detections

Analytics

CVE-2012-2978

high

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium

medium