CWE-168

A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut

A malformed zone may contain an NS or DNAME node above its origin, which `named` treats as a zone cut. If an attacker inserts a malformed zone into a BIND authoritative server (e.g., via zone transfer), queries for names inside the confi…