Libvirt Security Notice: LSN-2012-0001

DNS configured to answer DNS queries from non-virtual networks

Lifecycle

Credits

See also

• CVE-2012-3411

Description

The DNS server run on the virtual networks did not restrict what source interfaces it was prepared to answer queries from. It was only supposed to answer queries from guest interfaces, however, it could answer queries from the public interfaces

Impact

If the virtual network is configured with a public IP address range, then it would effectively operate as an open DNS server for the world, instead of just the virtual machines.

Workaround

Do not configure the virtual network with public IP address ranges, or use network router firewall rules to block access to the DNS ports on the virtualization host

Affected product: libvirt

Alternative formats: [xml] [text]