Nsauditor 3.0.28 and 3.2.1.0 contains a buffer overflow vulnerability in the DNS Lookup tool that allows attackers to execute arbitrary code by overwriting memo…

CVE-2020-37119 affects Nsauditor versions 3.0.28 and 3.2.1.0, containing a buffer overflow vulnerability in the DNS Lookup tool. Attackers can exploit this vulnerability by crafting malicious DNS query payloads that trigger a three-byte memory overwrite. The exploit allows bypassing ASLR (Address Space Layout Randomization) protection mechanisms. Successful exploitation enables arbitrary code execution through carefully constructed shellcode. The vulnerability demonstrates how network security tools themselves can become attack vectors when containing memory corruption flaws.