Afldl

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the normal handshake, before certificate verification completes.

The TLS 1.3 Certificate-message parser in NetX Secure decrements the message length to skip a context byte without first establishing that the message has a byte to skip. A zero-length Certificate message therefore wraps the unsigned length to `0xFFFFFFFF`, which makes the bounds check that follows vacuous and sends the parser reading past the session packet buffer. The trigger is a four-byte handshake header and requires no cryptographic validity. It is reachable pre-authentication.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** During the first DTLS ClientHello, the parser copies a device-claimed `session id` length and validates the ciphersuite-list length against the total record length rather than the remaining bytes. This allows an unauthenticated peer to trigger an Out-of-Bounds (OOB) source read of up to 255 bytes. These bytes are then echoed verbatim into the outgoing ServerHello, resulting in the disclosure of adjacent process memory over the network. A variant of this issue can also cause a crash upon receiving the first packet. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NetX Secure (affected versions not specified) **Description** The software generates predictable cookies during the DTLS HelloVerifyRequest process. This predictability can be exploited to bypass the cookie-based mechanism intended to prevent Denial of Service (DoS) attacks, which are attempts to make a machine or network resource unavailable to its intended users. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** NSD (affected versions not specified) **Description** A remote client can cause a crash of the NSD serve child process in debugging or non-release build types. This occurs when the process receives a specially crafted message containing a specific number of DNS Cookie options, such as 17 options when the UDP payload size is 512. Repeatedly crashing these processes can severely degrade performance or lead to a complete denial of DNS service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات GNU SASL الأقدم من 2.2.4 **الوصف** يفتقر عميل NTLM إلى عملية تنقية التحدي القصير داخل الدالة ` gsasl ntlm client step()`. تسمح هذه الثغرة لخادم مصمم خصيصًا للتلاعب بإحداث تسرب للذاكرة. **التوصيات** التحديث إلى الإصدار 2.2.4 أو أحدث.