Описание
When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compared with IPv4 ranges as unsigned 32 bit numbers directly with the endianness of the host, but the values to compare are in network byte order (big-endian). With IPv6 addresses the comparison is done in 4 times a unsigned 32 bit number comparison, again with the endianness of the host where all values are actually in network bye order.
A flaw was found in NSD. On systems using little-endian architecture, the software incorrectly compares IP addresses against defined Access Control List (ACL) ranges. This misinterpretation can lead to a bypass of intended access controls, where IP addresses that should be denied access are instead allowed, and vice versa. This could result in unauthorized access to resources or services.
Отчет
This vulnerability is evaluated as having an Important severity because unauthenticated remote attackers can bypass configured access control policies on common little-endian platforms (such as x86_64 and aarch64), granting unauthorized network hosts access to restricted DNS operations like zone transfers. Although exploitation does not lead to remote code execution, it directly compromises confidentiality by permitting unintended zone data retrieval. The issue specifically requires administrators to configure hyphen-separated IP ranges in access control lists rather than discrete IP addresses. NSD is not distributed as part of core Red Hat Enterprise Linux, though it is packaged in Fedora and EPEL.
Меры по смягчению последствий
To mitigate this issue, restrict network access to the NSD service using external firewall rules. Configure the firewall to only allow connections from trusted IP addresses or networks that are authorized to access the NSD server, thereby preventing unauthorized access attempts before they reach the vulnerable NSD access control logic. Ensure that any changes to firewall rules are thoroughly tested to avoid disrupting legitimate service.
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compared with IPv4 ranges as unsigned 32 bit numbers directly with the endianness of the host, but the values to compare are in network byte order (big-endian). With IPv6 addresses the comparison is done in 4 times a unsigned 32 bit number comparison, again with the endianness of the host where all values are actually in network bye order.
When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compared with IPv4 ranges as unsigned 32 bit numbers directly with the endianness of the host, but the values to compare are in network byte order (big-endian). With IPv6 addresses the comparison is done in 4 times a unsigned 32 bit number comparison, again with the endianness of the host where all values are actually in network bye order.
When ranges are used for access control (i.e. of the form 1.2.3.4-1.2. ...
When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compared with IPv4 ranges as unsigned 32 bit numbers directly with the endianness of the host, but the values to compare are in network byte order (big-endian). With IPv6 addresses the comparison is done in 4 times a unsigned 32 bit number comparison, again with the endianness of the host where all values are actually in network bye order.
ALT-PU-2026-14204: package `nsd` update to version 4.15.1-alt1
EPSS
7.5 High
CVSS3