CVE-2012-3411: Input Validation
Dnsmasq before 2.63test1, when used with certain libvirt configurations, replies to requests from prohibited interfaces, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed DNS query.
Other sources
I just found my home ADSL line under "attack" with a constant stream of spoofed DNS queries which produce large results, such as 'ANY' requests for 'ripe.net'.
I was surprised to find that my machine was actually responding to these queries.
I have libvirt configured to give a range of public IP addresses to its guests. The target of the attack was the host's IP address on that subnet, 81.187.2.161.
It seems that your dnsmasq instance is listening on that address, but not correctly discarding packets which come from a different interface. Even though the --bind-interface option is set. This is the command line:
/sbin/dnsmasq --strict-order --bind-interfaces --pid-file=/var/run/libvirt/network/net3.pid --conf-file= --except-interface lo --listen-address 81.187.2.161 --dhcp-range 81.187.2.168,81.187.2.174 --dhcp-leasefile=/var/lib/libvirt/dnsmasq/net3.leases --dhcp-lease-max=7 --dhcp-no-override
I tried using '--interface virbr1' instead of '--except-interface lo', but it still seemed to answer external queries:
/sbin/dnsmasq --strict-order --bind-interfaces --pid-file=/var/run/libvirt/network/net3.pid --conf-file= --interface virbr1 --listen-address 81.187.2.161 --dhcp-range 81.187.2.168,81.187.2.174 --dhcp-leasefile=/var/lib/libvirt/dnsmasq/net3.leases --dhcp-lease-max=7 --dhcp-no-override
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3411?
CVE-2012-3411 has a severity associated with denial of service due to potential traffic amplification.
How do I fix CVE-2012-3411?
To fix CVE-2012-3411, update to a version of dnsmasq newer than 2.63test1.
Who is affected by CVE-2012-3411?
CVE-2012-3411 affects users of dnsmasq versions prior to 2.63test1, especially with specific libvirt configurations.
What type of attack does CVE-2012-3411 facilitate?
CVE-2012-3411 facilitates denial of service attacks through traffic amplification via spoofed DNS queries.
Is CVE-2012-3411 a local or remote vulnerability?
CVE-2012-3411 is a remote vulnerability that allows attackers to exploit it from a distance.