EMBARGOED via direkt contact:

        Libvirt Security Notice: LSN-2014-0003
        ======================================

       Summary: Unsafe parsing of XML documents allows arbitrary
                file read
   Reported on: 20140411
  Published on:
      Fixed on:
   Reported by: Daniel P. Berrange <berrange@redhat.com>
                Richard Jones <rjones@redhat.com>
    Patched by: Daniel P. Berrange <berrange@redhat.com>
      See also: CVE-XXXX-XXXX

Description
-----------

When parsing XML documents, libvirt passes the XML_PARSE_NOENT flag
to libxml2 which instructs it to expand all entities in the XML
document during parsing. This can be used to insert the contents of
host OS files in the resulting parsed content. Although the flag was
mistakenly introduced in version 0.0.5, the usage only becomes a
vulnerablity once the fine grained access control mechanism is
introduced in version 1.0.0.

Impact
------

A malicious user can pass libvirt an XML document which contains an
entity that points to an arbitrary file on the host. When libvirt
parses this document, it will insert the contents of that host file,
which could allow the user to read the contents of files that they
otherwise do not have permission to view. It also has the potential
to cause a denial of service if the entity points to a named pipe
with no writer connected. If the libvirt installation is not using
fine grained access control then any user of the affected APIs is
already considered to have privileges equivalent to root. If the
libvirt installation is using fine grained access control, then the
following APIs can be considered vulnerable: virDomainDefineXML,
virNetworkCreateXML, virNetworkDefineXML, virStoragePoolCreateXML,
virStoragePoolDefineXML, virStorageVolCreateXML, virDomainCreateXML,
virNodeDeviceCreateXML, virInterfaceDefineXML,
virStorageVolCreateXMLFrom, virConnectDomainXMLFromNative,
virConnectDomainXMLToNative, virSecretDefineXML,
virNWFilterDefineXML, virDomainSnapshotCreateXML,
virDomainSaveImageDefineXML, virDomainCreateXMLWithFiles,
virConnectCompareCPU, virConnectBaselineCPU.

Workaround
----------

Stop use of the fine grained access control mechanism, and restrict
access to the libvirt read-write TCP/UNIX sockets to only trusted
users. Simply denying access to the affected APIs in the access
control policy is insufficient to mitigate the bug, since the XML
document typically needs to be parsed before the access control
check is applied in order to extra the UUID/name of the object to
check.

Affected product
----------------

        Name: libvirt
  Repository: git://libvirt.org/git/libvirt.git
              http://libvirt.org/git/?p=libvirt.git

      Branch: master
   Broken in: v1.1.0
   Broken in: v1.1.1
   Broken in: v1.1.2
   Broken in: v1.1.3
   Broken in: v1.1.4
   Broken in: v1.2.0
   Broken in: v1.2.1
   Broken in: v1.2.2
   Broken in: v1.2.3
    Fixed in:
   Broken by: ed3bac713c3cfc055ef551cbfe92a061084382c3
    Fixed by:

      Branch: v1.1.0-maint
    Fixed in:
   Broken by: ed3bac713c3cfc055ef551cbfe92a061084382c3
    Fixed by:

      Branch: v1.1.1-maint
    Fixed in:
   Broken by: ed3bac713c3cfc055ef551cbfe92a061084382c3
    Fixed by:

      Branch: v1.1.2-maint
    Fixed in:
   Broken by: ed3bac713c3cfc055ef551cbfe92a061084382c3
    Fixed by:

      Branch: v1.1.3-maint
   Broken in: v1.1.3.1
   Broken in: v1.1.3.2
   Broken in: v1.1.3.3
   Broken in: v1.1.3.4
    Fixed in:
   Broken by: ed3bac713c3cfc055ef551cbfe92a061084382c3
    Fixed by:

      Branch: v1.1.4-maint
    Fixed in:
   Broken by: ed3bac713c3cfc055ef551cbfe92a061084382c3
    Fixed by:

      Branch: v1.2.0-maint
    Fixed in:
   Broken by: ed3bac713c3cfc055ef551cbfe92a061084382c3
    Fixed by:

      Branch: v1.2.1-maint
    Fixed in:
   Broken by: ed3bac713c3cfc055ef551cbfe92a061084382c3
    Fixed by:

      Branch: v1.2.2-maint
    Fixed in:
   Broken by: ed3bac713c3cfc055ef551cbfe92a061084382c3
    Fixed by:


The suggested fix was also attached:

Subject: [PATCH] LSN-2014-0003: Don't expand entities when parsing XML

If the XML_PARSE_NOENT flag is passed to libxml2, then any
entities in the input document will be fully expanded. This
allows the user to read arbitrary files on the host machine
by creating an entity pointing to a local file. Removing
the XML_PARSE_NOENT flag means that any entities are left
unchanged by the parser, or expanded to "" by the XPath
APIs.

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>
---
 src/util/virxml.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/util/virxml.c b/src/util/virxml.c
index 9f00f62..34af64a 100644
--- a/src/util/virxml.c
+++ b/src/util/virxml.c
@@ -746,11 +746,11 @@ virXMLParseHelper(int domcode,

     if (filename) {
         xml = xmlCtxtReadFile(pctxt, filename, NULL,
-                              XML_PARSE_NOENT | XML_PARSE_NONET |
+                              XML_PARSE_NONET |
                               XML_PARSE_NOWARNING);
     } else {
         xml = xmlCtxtReadDoc(pctxt, BAD_CAST xmlStr, url, NULL,
-                             XML_PARSE_NOENT | XML_PARSE_NONET |
+                             XML_PARSE_NONET |
                              XML_PARSE_NOWARNING);
     }
     if (!xml)
-- 
1.9.0


CVE-2014-0179 was assigned to this issue.