bugtraq - possible issue with IPv4 mapped address and $REMOTE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20031029055821.494DF13@coconut.itojun.org>
Date: Wed, 29 Oct 2003 14:58:21 +0900
From: itojun@...lab.net
To: bugtraq@...urityfocus.com
Subject: possible issue with IPv4 mapped address and $REMOTE_ADDR in CGI


	because of the difference in http server in handling IPv4 mapped
	address (IPv4 traffic goes into the system into AF_INET6 socket),
	the peer's address passed by $REMOTE_ADDR to CGI script can vary
	between the http server.
	some http server would pass IPv4 mapped address as is (::ffff:10.1.1.1),
	and some http server would pass IPv4 mapped address converted into
	IPv4 address (10.1.1.1).  this complexity could confuse CGI program
	writers and could open up vulnerability if CGI program uses
	$REMOTE_ADDR for authentication.

	solution: do not accept IPv4 traffic by using AF_INET6 socket.  use
	AF_INET socket (http server should listen to AF_INET and AF_INET6
	socket explicitly).  draft-cmetz-v6ops-v4mapped-api-harmful-01.txt
	talks more about this issue.

itojun