A local buffer overflow vulnerability in Nsauditor 3.0.28.0 allows an attacker to achieve arbitrary code execution by injecting malicious payloads into the DNS Query field.

This is a structured exception handling (SEH) buffer overflow (CWE-787) triggered by supplying a specially crafted input to the DNS Lookup tool. The vulnerability can be exploited by an unauthenticated local user to gain code execution under the context of the application.

Successful exploitation of this vulnerability allows a local attacker to execute arbitrary code with the privileges of the Nsauditor application. This can lead to a complete compromise of the affected system, unauthorized data access, or the deployment of persistent malware. Given the CVSS score of 8.4, this vulnerability represents a high risk to organizational security, particularly for workstations or servers where Nsauditor is actively utilized by multiple users.

Immediate Action: Since no official patch is currently available, users should restrict access to the Nsauditor application to authorized personnel only. If the application is not required for daily business operations, consider uninstalling it until a vendor-supplied update is released.

Proactive Monitoring: Security teams should monitor system logs for suspicious process execution patterns or unexpected crashes of the Nsauditor executable, which may indicate an attempt to exploit the buffer overflow.

Compensating Controls: Implement endpoint protection solutions that utilize memory protection features, such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR), to disrupt exploitation attempts.

Public Exploit Available: Yes, a public exploit exists as documented in the Exploit-DB entry 46005.

The presence of a public exploit significantly elevates the risk associated with this vulnerability. Organizations using Nsauditor 3.0.28.0 must prioritize restricting access to the software to prevent local attackers from leveraging this flaw. Monitor vendor communication channels closely for any future security updates and apply them immediately upon availability.