865
IP addresses are more reliable than DNS names, but they can also be spoofed. Attackers can
easily forge the source IP address of the packets they send, but response packets will return to the
forged IP address. To see the response packets, the attacker has to sniff the traffic between the
victim machine and the forged IP address. In order to accomplish the required sniffing, attackers
typically attempt to locate themselves on the same subnet as the victim machine. Attackers may
be able to circumvent this requirement by using source routing, but source routing is disabled
across much of the Internet today. In summary, IP address verification can be a useful part of an
authentication scheme, but it should not be the single factor required for authentication.
Example 2:
In these examples, a connection is established if a request is made by a trusted host.
Example Language: C (Bad)
sd = socket(AF_INET, SOCK_DGRAM, 0);
serv.sin_family = AF_INET;
serv.sin_addr.s_addr = htonl(INADDR_ANY);
servr.sin_port = htons(1008);
bind(sd, (struct sockaddr *) & serv, sizeof(serv));
while (1) {
memset(msg, 0x0, MAX_MSG);
clilen = sizeof(cli);
h=gethostbyname(inet_ntoa(cliAddr.sin_addr));
if (h->h_name==...) n = recvfrom(sd, msg, MAX_MSG, 0, (struct sockaddr *) & cli, &clilen);
}
Example Language: Java (Bad)
while(true) {
DatagramPacket rp=new DatagramPacket(rData,rData.length);
outSock.receive(rp);
String in = new String(p.getData(),0, rp.getLength());
InetAddress IPAddress = rp.getAddress();
int port = rp.getPort();
if ((rp.getHostName()==...) & (in==...)) {
out = secret.getBytes();
DatagramPacket sp =new DatagramPacket(out,out.length, IPAddress, port);
outSock.send(sp);
}
}
These examples check if a request is from a trusted host before responding to a request, but
the code only verifies the hostname as stored in the request packet. An attacker can spoof the
hostname, thus impersonating a trusted client.
Observed Examples
Reference Description
CVE-2001-1488 Does not do double-reverse lookup to prevent DNS spoofing.
https://www.cve.org/CVERecord?id=CVE-2001-1488
CVE-2001-1500 Does not verify reverse-resolved hostnames in DNS.
https://www.cve.org/CVERecord?id=CVE-2001-1500
CVE-2000-1221 Authentication bypass using spoofed reverse-resolved DNS hostnames.
https://www.cve.org/CVERecord?id=CVE-2000-1221
CVE-2002-0804 Authentication bypass using spoofed reverse-resolved DNS hostnames.
https://www.cve.org/CVERecord?id=CVE-2002-0804
CVE-2001-1155 Filter does not properly check the result of a reverse DNS lookup, which
could allow remote attackers to bypass intended access restrictions via DNS
spoofing.
https://www.cve.org/CVERecord?id=CVE-2001-1155
CVE-2004-0892 Reverse DNS lookup used to spoof trusted content in intermediary.
CWE Version 4.14
CWE-351: Insufficient Type Distinction
CWE-351: Insufficient Type Distinction