Netskope Client Memory Leak Vulnerability via Crafted DNS Packets

A memory leak vulnerability has been identified in the Netskope Client (NS Client) for Windows, all versions prior to R129. This vulnerability allows a malicious actor to leak user-controllable memory by sending a crafted DNS packet to the affected machine. Exploitation may require administrative privileges, depending on the machine's configuration.

Impact

Exploitation of this vulnerability can lead to an out-of-bounds read, causing a memory leak of user-controllable data, specifically a domain name stored on the local machine.

Remediation

Netskope has released a security patch for this vulnerability in version R129 and above. Instructions for downloading the updated client are available on the Netskope Support website.