Dnsmasq before 2.63test1, when used with certain libvirt configurations, replies to requests from prohibited interfaces, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed DNS query.

The remote dnsmasq server is running a version prior to 2.63test1. It is, therefore, affected by a denial of service vulnerability in libvirtd due to improper parsing of malformed network packets. An unauthenticated, remote attacker can exploit this to cause an amplification of a large amount of DNS queries, resulting in a denial of service condition.

An updated rhev-hypervisor6 package that fixes three security issues, various bugs, and adds an enhancement is now available.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The rhev-hypervisor6 package provides a Red Hat Enterprise Virtualization Hypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor is a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes everything necessary to run and manage virtual machines: A subset of the Red Hat Enterprise Linux operating environment and the Red Hat Enterprise Virtualization Agent.

Note: Red Hat Enterprise Virtualization Hypervisor is only available for the Intel 64 and AMD64 architectures with virtualization extensions.

A flaw was found in the way the vhost kernel module handled descriptors that spanned multiple regions. A privileged guest user could use this flaw to crash the host or, potentially, escalate their privileges on the host. (CVE-2013-0311)

It was found that the default SCSI command filter does not accommodate commands that overlap across device classes. A privileged guest user could potentially use this flaw to write arbitrary data to a LUN that is passed-through as read-only. (CVE-2012-4542)

It was discovered that dnsmasq, when used in combination with certain libvirtd configurations, could incorrectly process network packets from network interfaces that were intended to be prohibited. A remote, unauthenticated attacker could exploit this flaw to cause a denial of service via DNS amplification attacks. (CVE-2012-3411)

The CVE-2012-4542 issue was discovered by Paolo Bonzini of Red Hat.

This updated package provides updated components that include fixes for several security issues. These issues had no security impact on Red Hat Enterprise Virtualization Hypervisor itself, however. The security fixes included in this update address the following CVE numbers :

CVE-2012-3955 (dhcp issue)

CVE-2011-4355 (gdb issue)

CVE-2012-4508, CVE-2013-0190, CVE-2013-0309, and CVE-2013-0310 (kernel issues)

CVE-2012-5536 (openssh issue)

CVE-2011-3148 and CVE-2011-3149 (pam issues)

CVE-2013-0157 (util-linux-ng issue)

This updated Red Hat Enterprise Virtualization Hypervisor package also fixes the following bugs :

* Previously, the Administration Portal would always display the option to upgrade the Red Hat Enterprise Virtualization Hypervisor ISO regardless of whether or not the selected host was up-to-date. Now, the VDSM version compatibility is considered and the upgrade message only displays if there is an upgrade relevant to the host available.
(BZ#853092)

* An out of date version of libvirt was included in the Red Hat Enterprise Virtualization Hypervisor 6.4 package. As a result, virtual machines with supported CPU models were not being properly parsed by libvirt and failed to start. A more recent version of libvirt has been included in this updated hypervisor package. Virtual machines now start normally. (BZ#895078)

As well, this update adds the following enhancement :

* Hypervisor packages now take advantage of the installonlypkg function provided by yum. This allows for multiple versions of the hypervisor package to be installed on a system concurrently without making changes to the yum configuration as was previously required.
(BZ#863579)

This update includes the ovirt-node build from RHBA-2013:0556 :

https://rhn.redhat.com/errata/RHBA-2013-0556.html

Users of the Red Hat Enterprise Virtualization Hypervisor are advised to upgrade to this updated package, which fixes these issues and adds this enhancement.

The remote host is affected by the vulnerability described in GLSA-201406-24 (Dnsmasq: Denial of Service)

    When used with certain libvirt configurations Dnsmasq replies to queries       from prohibited interfaces.
  Impact :

    A remote attackers can cause a Denial of Service via spoofed TCP based       DNS queries.
  Workaround :

    There is no known workaround at this time.

It was discovered that dnsmasq, when used in combination with certain libvirtd configurations, could incorrectly process network packets from network interfaces that were intended to be prohibited. A remote, unauthenticated attacker could exploit this flaw to cause a denial of service via DNS amplification attacks. (CVE-2012-3411)

From Red Hat Security Advisory 2013:0277 :

Updated dnsmasq packages that fix one security issue, one bug, and add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server.

It was discovered that dnsmasq, when used in combination with certain libvirtd configurations, could incorrectly process network packets from network interfaces that were intended to be prohibited. A remote, unauthenticated attacker could exploit this flaw to cause a denial of service via DNS amplification attacks. (CVE-2012-3411)

In order to fully address this issue, libvirt package users are advised to install updated libvirt packages. Refer to RHSA-2013:0276 for additional information.

This update also fixes the following bug :

* Due to a regression, the lease change script was disabled.
Consequently, the 'dhcp-script' option in the /etc/dnsmasq.conf configuration file did not work. This update corrects the problem and the 'dhcp-script' option now works as expected. (BZ#815819)

This update also adds the following enhancements :

* Prior to this update, dnsmasq did not validate that the tftp directory given actually existed and was a directory. Consequently, configuration errors were not immediately reported on startup. This update improves the code to validate the tftp root directory option.
As a result, fault finding is simplified especially when dnsmasq is called by external processes such as libvirt. (BZ#824214)

* The dnsmasq init script used an incorrect Process Identifier (PID) in the 'stop', 'restart', and 'condrestart' commands. Consequently, if there were some dnsmasq instances running besides the system one started by the init script, then repeated calling of 'service dnsmasq' with 'stop' or 'restart' would kill all running dnsmasq instances, including ones not started with the init script. The dnsmasq init script code has been corrected to obtain the correct PID when calling the 'stop', 'restart', and 'condrestart' commands. As a result, if there are dnsmasq instances running in addition to the system one started by the init script, then by calling 'service dnsmasq' with 'stop' or 'restart' only the system one is stopped or restarted.
(BZ#850944)

* When two or more dnsmasq processes were running with DHCP enabled on one interface, DHCP RELEASE packets were sometimes lost. Consequently, when two or more dnsmasq processes were running with DHCP enabled on one interface, releasing IP addresses sometimes failed. This update sets the SO_BINDTODEVICE socket option on DHCP sockets if running dnsmasq with DHCP enabled on one interface. As a result, when two or more dnsmasq processes are running with DHCP enabled on one interface, they can release IP addresses as expected. (BZ#887156)

All users of dnsmasq are advised to upgrade to these updated packages, which fix these issues and add these enhancements.

From Red Hat Security Advisory 2013:0276 :

Updated libvirt packages that fix one security issue, multiple bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

It was discovered that libvirt made certain invalid assumptions about dnsmasq's command line options when setting up DNS masquerading for virtual machines, resulting in dnsmasq incorrectly processing network packets from network interfaces that were intended to be prohibited.
This update includes the changes necessary to call dnsmasq with a new command line option, which was introduced to dnsmasq via RHSA-2013:0277. (CVE-2012-3411)

In order for libvirt to be able to make use of the new command line option (--bind-dynamic), updated dnsmasq packages need to be installed. Refer to RHSA-2013:0277 for additional information.

These updated libvirt packages include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.4 Technical Notes, linked to in the References, for information on the most significant of these changes.

All users of libvirt are advised to upgrade to these updated packages, which fix these issues and add these enhancements. After installing the updated packages, libvirtd must be restarted ('service libvirtd restart') for this update to take effect.

Updated dnsmasq packages fix security vulnerabilities :

When dnsmasq before 2.63 is used in conjunctions with certain configurations of libvirtd, network packets from prohibited networks (e.g. packets that should not be passed in) may be sent to the dnsmasq application and processed. This can result in DNS amplification attacks for example (CVE-2012-3411).

This update adds a new option --bind-dynamic which is immune to this problem.

Updated dnsmasq packages fix security vulnerabilities (CVE-2013-0198) :

This update completes the fix for CVE-2012-3411 provided with dnsmasq-2.63. It was found that after the upstream patch for CVE-2012-3411 issue was applied, dnsmasq still :

  - replied to remote TCP-protocol based DNS queries (UDP     protocol ones were corrected, but TCP ones not) from     prohibited networks, when the --bind-dynamic option was     used,

  - when --except-interface lo option was used dnsmasq     didn't answer local or remote UDP DNS queries, but still     allowed TCP protocol based DNS queries,

  - when --except-interface lo option was not used local /     remote TCP DNS queries were also still answered by     dnsmasq.

This update fix these three cases.

Updated dnsmasq packages that fix one security issue, one bug, and add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server.

It was discovered that dnsmasq, when used in combination with certain libvirtd configurations, could incorrectly process network packets from network interfaces that were intended to be prohibited. A remote, unauthenticated attacker could exploit this flaw to cause a denial of service via DNS amplification attacks. (CVE-2012-3411)

In order to fully address this issue, libvirt package users are advised to install updated libvirt packages. Refer to RHSA-2013:0276 for additional information.

This update also fixes the following bug :

* Due to a regression, the lease change script was disabled.
Consequently, the 'dhcp-script' option in the /etc/dnsmasq.conf configuration file did not work. This update corrects the problem and the 'dhcp-script' option now works as expected. (BZ#815819)

This update also adds the following enhancements :

* Prior to this update, dnsmasq did not validate that the tftp directory given actually existed and was a directory. Consequently, configuration errors were not immediately reported on startup. This update improves the code to validate the tftp root directory option.
As a result, fault finding is simplified especially when dnsmasq is called by external processes such as libvirt. (BZ#824214)

* The dnsmasq init script used an incorrect Process Identifier (PID) in the 'stop', 'restart', and 'condrestart' commands. Consequently, if there were some dnsmasq instances running besides the system one started by the init script, then repeated calling of 'service dnsmasq' with 'stop' or 'restart' would kill all running dnsmasq instances, including ones not started with the init script. The dnsmasq init script code has been corrected to obtain the correct PID when calling the 'stop', 'restart', and 'condrestart' commands. As a result, if there are dnsmasq instances running in addition to the system one started by the init script, then by calling 'service dnsmasq' with 'stop' or 'restart' only the system one is stopped or restarted.
(BZ#850944)

* When two or more dnsmasq processes were running with DHCP enabled on one interface, DHCP RELEASE packets were sometimes lost. Consequently, when two or more dnsmasq processes were running with DHCP enabled on one interface, releasing IP addresses sometimes failed. This update sets the SO_BINDTODEVICE socket option on DHCP sockets if running dnsmasq with DHCP enabled on one interface. As a result, when two or more dnsmasq processes are running with DHCP enabled on one interface, they can release IP addresses as expected. (BZ#887156)

All users of dnsmasq are advised to upgrade to these updated packages, which fix these issues and add these enhancements.

Updated libvirt packages that fix one security issue, multiple bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The libvirt library is a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

It was discovered that libvirt made certain invalid assumptions about dnsmasq's command line options when setting up DNS masquerading for virtual machines, resulting in dnsmasq incorrectly processing network packets from network interfaces that were intended to be prohibited.
This update includes the changes necessary to call dnsmasq with a new command line option, which was introduced to dnsmasq via RHSA-2013:0277. (CVE-2012-3411)

In order for libvirt to be able to make use of the new command line option (--bind-dynamic), updated dnsmasq packages need to be installed. Refer to RHSA-2013:0277 for additional information.

These updated libvirt packages include numerous bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.4 Technical Notes, linked to in the References, for information on the most significant of these changes.

All users of libvirt are advised to upgrade to these updated packages, which fix these issues and add these enhancements. After installing the updated packages, libvirtd must be restarted ('service libvirtd restart') for this update to take effect.

It was discovered that libvirt made certain invalid assumptions about dnsmasq's command line options when setting up DNS masquerading for virtual machines, resulting in dnsmasq incorrectly processing network packets from network interfaces that were intended to be prohibited.
This update includes the changes necessary to call dnsmasq with a new command line option, which was introduced to dnsmasq via SLSA-2013:0277. (CVE-2012-3411)

In order for libvirt to be able to make use of the new command line option (--bind-dynamic), updated dnsmasq packages need to be installed. Refer to SLSA-2013:0277 for additional information.

After installing the updated packages, libvirtd must be restarted ('service libvirtd restart') for this update to take effect.

It was discovered that dnsmasq, when used in combination with certain libvirtd configurations, could incorrectly process network packets from network interfaces that were intended to be prohibited. A remote, unauthenticated attacker could exploit this flaw to cause a denial of service via DNS amplification attacks. (CVE-2012-3411)

In order to fully address this issue, libvirt package users are advised to install updated libvirt packages.

This update also fixes the following bug :

  - Due to a regression, the lease change script was     disabled. Consequently, the 'dhcp-script' option in the     /etc/dnsmasq.conf configuration file did not work. This     update corrects the problem and the 'dhcp-script' option     now works as expected.

This update also adds the following enhancements :

  - Prior to this update, dnsmasq did not validate that the     tftp directory given actually existed and was a     directory. Consequently, configuration errors were not     immediately reported on startup. This update improves     the code to validate the tftp root directory option. As     a result, fault finding is simplified especially when     dnsmasq is called by external processes such as libvirt.

  - The dnsmasq init script used an incorrect Process     Identifier (PID) in the 'stop', 'restart', and     'condrestart' commands. Consequently, if there were some     dnsmasq instances running besides the system one started     by the init script, then repeated calling of 'service     dnsmasq' with 'stop' or 'restart' would kill all running     dnsmasq instances, including ones not started with the     init script. The dnsmasq init script code has been     corrected to obtain the correct PID when calling the     'stop', 'restart', and 'condrestart' commands. As a     result, if there are dnsmasq instances running in     addition to the system one started by the init script,     then by calling 'service dnsmasq' with 'stop' or     'restart' only the system one is stopped or restarted.

  - When two or more dnsmasq processes were running with     DHCP enabled on one interface, DHCP RELEASE packets were     sometimes lost. Consequently, when two or more dnsmasq     processes were running with DHCP enabled on one     interface, releasing IP addresses sometimes failed. This     update sets the SO_BINDTODEVICE socket option on DHCP     sockets if running dnsmasq with DHCP enabled on one     interface. As a result, when two or more dnsmasq     processes are running with DHCP enabled on one     interface, they can release IP addresses as expected.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:0276 advisory.

  - libvirt+dnsmasq: DNS configured to answer DNS queries from non-virtual networks (CVE-2012-3411)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

From dnsmasq's CHANGELOG :

Add code to make behaviour for TCP DNS requests that same as for UDP requests, when a request arrives for an allowed address, but via a banned interface. This change is only active on Linux, since the relevant API is missing (AFAIK) on other platforms.

  - dnsmasq now answers local queries if --except-interface     lo is used (libvirt's use case).

  - dnsmasq is now built with $RPM_OPT_FLAGS, $RPM_LD_FLAGS     explicitly.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fix conflict with NM launched dnsmasq (bz #886663)

    - Rebased to version 0.9.11.8

    - CVE-2012-3411: avoid open DNS proxy with dnsmasq (bz       #874702, bz #882309)

    - Don't ignore address for USB disks (bz #861309)

    - Fix error with blkdeviotune (bz #872582)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fix scriplet warning when uninstalling libvirt-client     (bz #888071)

    - Fix conflict with NM launched dnsmasq (bz #886663)

    - Fix selinux denials when launching non-kvm qemu guests       (bz #885837)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

2.63 release

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
87594	dnsmasq < 2.63test1 libvirtd TCP Network Packet Parsing Response DNS Amplification DoS	Nessus	DNS	medium
78950	RHEL 6 : rhev-hypervisor6 (RHSA-2013:0579)	Nessus	Red Hat Local Security Checks	medium
76226	GLSA-201406-24 : Dnsmasq: Denial of Service	Nessus	Gentoo Local Security Checks	medium
69720	Amazon Linux AMI : dnsmasq (ALAS-2013-161)	Nessus	Amazon Linux Local Security Checks	medium
68738	Oracle Linux 6 : dnsmasq (ELSA-2013-0277)	Nessus	Oracle Linux Local Security Checks	medium
68737	Oracle Linux 6 : libvirt (ELSA-2013-0276)	Nessus	Oracle Linux Local Security Checks	medium
66086	Mandriva Linux Security Advisory : dnsmasq (MDVSA-2013:072)	Nessus	Mandriva Local Security Checks	medium
65133	CentOS 6 : dnsmasq (CESA-2013:0277)	Nessus	CentOS Local Security Checks	medium
65132	CentOS 6 : libvirt (CESA-2013:0276)	Nessus	CentOS Local Security Checks	medium
64953	Scientific Linux Security Update : libvirt on SL6.x i386/x86_64 (20130221)	Nessus	Scientific Linux Local Security Checks	medium
64950	Scientific Linux Security Update : dnsmasq on SL6.x i386/x86_64 (20130221)	Nessus	Scientific Linux Local Security Checks	medium
64750	RHEL 6 : dnsmasq (RHSA-2013:0277)	Nessus	Red Hat Local Security Checks	medium
64749	RHEL 6 : libvirt (RHSA-2013:0276)	Nessus	Red Hat Local Security Checks	high
64672	Fedora 17 : dnsmasq-2.65-4.fc17 (2013-1320)	Nessus	Fedora Local Security Checks	medium
64592	Fedora 18 : dnsmasq-2.65-4.fc18 (2013-1357)	Nessus	Fedora Local Security Checks	medium
63375	Fedora 17 : libvirt-0.9.11.8-2.fc17 (2012-20531)	Nessus	Fedora Local Security Checks	medium
63311	Fedora 18 : libvirt-0.10.2.2-3.fc18 (2012-20577)	Nessus	Fedora Local Security Checks	medium
62050	Fedora 17 : dnsmasq-2.63-1.fc17 (2012-12598)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2012-3411

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium