An unauthenticated attacker can cause a denial of service in Nsasoft Dnss Domain Name Search Software by providing a specially crafted, oversized registration key to the application.

The application is susceptible to a classic buffer overflow (CWE-120) when processing the registration key field. An attacker can input a 1000-character payload into the registration key field, resulting in an unhandled exception and subsequent application crash.

The exploitation of this vulnerability results in a denial of service, rendering the software unavailable to legitimate users. While the CVSS score of 7.5 indicates a high severity, the impact is localized to the availability of the specific application on the host machine. Service disruption may lead to operational delays for organizations relying on this software for domain management tasks.

Immediate Action: As no official patch is currently available, users should restrict access to the application to trusted personnel only. Avoid entering untrusted or excessively long registration keys into the software interface.

Proactive Monitoring: Monitor the host system for unexpected application terminations or process crashes related to the software. Review system event logs for error reports associated with the Dnss process.

Compensating Controls: Deploy endpoint protection solutions that can detect and block buffer overflow attempts at the process level. Implement application whitelisting to ensure only authorized users can execute or interact with the software.

Public Exploit Available: Yes, a proof-of-concept exploit is available via ExploitDB (EDB-ID 47856).

Given the availability of a public proof-of-concept and the lack of a vendor patch, users must treat this vulnerability as a credible threat to service availability. Organizations should prioritize isolating instances of this software and restricting input access to prevent unauthorized parties from triggering the crash condition.