<security-notice xmlns="http://security.libvirt.org/xmlns/security-notice/1.0">
  <id>2012-0001</id>

  <summary>DNS configured to answer DNS queries from non-virtual networks</summary>

  <description>
<![CDATA[The DNS server run on the virtual networks did not restrict what
source interfaces it was prepared to answer queries from. It was only
supposed to answer queries from guest interfaces, however, it could answer
queries from the public interfaces]]>
  </description>

  <impact>
<![CDATA[If the virtual network is configured with a public IP address
range, then it would effectively operate as an open DNS server for the
world, instead of just the virtual machines.]]>
  </impact>

  <workaround>
<![CDATA[Do not configure the virtual network with public IP address
ranges, or use network router firewall rules to block access to the
DNS ports on the virtualization host]]>
  </workaround>

  <credits>
    <reporter>
      <name>David Woodhouse</name>
      <email>dwmw2@infradead.org</email>
    </reporter>
    <patcher>
      <name>Laine Stump</name>
      <email>laine@laine.org</email>
    </patcher>
  </credits>

  <lifecycle>
    <reported>20120618</reported>
    <published>20120709</published>
    <fixed>20121129</fixed>
  </lifecycle>

  <reference>
    <advisory type="CVE" id="2012-3411"/>
  </reference>

  <product name="libvirt">
    <repository>libvirt.git</repository>
    <branch>
      <name>master</name>
      <tag state="vulnerable">v0.4.2</tag>
      <tag state="vulnerable">v0.4.4</tag>
      <tag state="vulnerable">v0.4.6</tag>
      <tag state="vulnerable">v0.5.0</tag>
      <tag state="vulnerable">v0.5.1</tag>
      <tag state="vulnerable">v0.6.0</tag>
      <tag state="vulnerable">v0.6.1</tag>
      <tag state="vulnerable">v0.6.2</tag>
      <tag state="vulnerable">v0.6.3</tag>
      <tag state="vulnerable">v0.6.4</tag>
      <tag state="vulnerable">v0.6.5</tag>
      <tag state="vulnerable">v0.7.0</tag>
      <tag state="vulnerable">v0.7.1</tag>
      <tag state="vulnerable">v0.7.2</tag>
      <tag state="vulnerable">v0.7.3</tag>
      <tag state="vulnerable">v0.7.4</tag>
      <tag state="vulnerable">v0.7.5</tag>
      <tag state="vulnerable">v0.7.6</tag>
      <tag state="vulnerable">v0.7.7</tag>
      <tag state="vulnerable">v0.8.0</tag>
      <tag state="vulnerable">v0.8.1</tag>
      <tag state="vulnerable">v0.8.2</tag>
      <tag state="vulnerable">v0.8.3</tag>
      <tag state="vulnerable">v0.8.4</tag>
      <tag state="vulnerable">v0.8.5</tag>
      <tag state="vulnerable">v0.8.6</tag>
      <tag state="vulnerable">v0.8.7</tag>
      <tag state="vulnerable">v0.8.8</tag>
      <tag state="vulnerable">v0.9.0</tag>
      <tag state="vulnerable">v0.9.1</tag>
      <tag state="vulnerable">v0.9.2</tag>
      <tag state="vulnerable">v0.9.3</tag>
      <tag state="vulnerable">v0.9.4</tag>
      <tag state="vulnerable">v0.9.5</tag>
      <tag state="vulnerable">v0.9.6</tag>
      <tag state="vulnerable">v0.9.7</tag>
      <tag state="vulnerable">v0.9.8</tag>
      <tag state="vulnerable">v0.9.9</tag>
      <tag state="vulnerable">v0.9.10</tag>
      <tag state="vulnerable">v0.9.11</tag>
      <tag state="vulnerable">v0.9.12</tag>
      <tag state="vulnerable">v0.9.13</tag>
      <tag state="vulnerable">v0.10.0</tag>
      <tag state="vulnerable">v0.10.1</tag>
      <tag state="vulnerable">v0.10.2</tag>
      <tag state="vulnerable">v1.0.0</tag>
      <change state="vulnerable">038b434f144fa9d24c6e4e9988707ee114973a8a</change>
      <tag state="fixed">v1.0.1</tag>
      <change state="fixed">753ff83a50263d6975f88d6605d4b5ddfcc97560</change>
    </branch>
    <branch>
      <name>v0.8.3-maint</name>
      <change state="vulnerable">038b434f144fa9d24c6e4e9988707ee114973a8a</change>
    </branch>
    <branch>
      <name>v0.9.6-maint</name>
      <tag state="vulnerable">v0.9.6.1</tag>
      <tag state="vulnerable">v0.9.6.2</tag>
      <tag state="vulnerable">v0.9.6.3</tag>
      <tag state="vulnerable">v0.9.6.4</tag>
      <change state="vulnerable">038b434f144fa9d24c6e4e9988707ee114973a8a</change>
    </branch>
    <branch>
      <name>v0.9.11-maint</name>
      <tag state="vulnerable">v0.9.11.1</tag>
      <tag state="vulnerable">v0.9.11.2</tag>
      <tag state="vulnerable">v0.9.11.3</tag>
      <tag state="vulnerable">v0.9.11.4</tag>
      <tag state="vulnerable">v0.9.11.5</tag>
      <tag state="vulnerable">v0.9.11.6</tag>
      <tag state="vulnerable">v0.9.11.7</tag>
      <change state="vulnerable">038b434f144fa9d24c6e4e9988707ee114973a8a</change>
      <tag state="fixed">v0.9.11.8</tag>
      <change state="fixed">2abde0ac0740e57c47ed684ce0d56195b977bdb3</change>
    </branch>
    <branch>
      <name>v0.9.12-maint</name>
      <tag state="vulnerable">v0.9.12.1</tag>
      <tag state="vulnerable">v0.9.12.2</tag>
      <tag state="vulnerable">v0.9.12.3</tag>
      <change state="vulnerable">038b434f144fa9d24c6e4e9988707ee114973a8a</change>
    </branch>
    <branch>
      <name>v0.10.2-maint</name>
      <tag state="vulnerable">v0.10.2.1</tag>
      <change state="vulnerable">038b434f144fa9d24c6e4e9988707ee114973a8a</change>
      <tag state="fixed">v0.10.2.2</tag>
      <change state="fixed">3fbab08a52fd8cabbf5639c6badd34ceff3e53fe</change>
    </branch>
    <branch>
      <name>v1.0.0-maint</name>
      <change state="vulnerable">038b434f144fa9d24c6e4e9988707ee114973a8a</change>
    </branch>
  </product>

</security-notice>
