Dnsmasq before 2.63test1 when used with certain libvirt configurations replies to requests from prohibited interfaces which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed DNS query.