[32211] in bugtraq
possible issue with IPv4 mapped address and $REMOTE_ADDR in CGI
daemon@ATHENA.MIT.EDU (itojun@iijlab.net)
Wed Oct 29 12:16:11 2003
To: bugtraq@securityfocus.com
X-Template-Reply-To: itojun@itojun.org
X-Template-Return-Receipt-To: itojun@itojun.org
From: itojun@iijlab.net
Date: Wed, 29 Oct 2003 14:58:21 +0900
Message-Id: <20031029055821.494DF13@coconut.itojun.org>
because of the difference in http server in handling IPv4 mapped
address (IPv4 traffic goes into the system into AF_INET6 socket),
the peer's address passed by $REMOTE_ADDR to CGI script can vary
between the http server.
some http server would pass IPv4 mapped address as is (::ffff:10.1.1.1),
and some http server would pass IPv4 mapped address converted into
IPv4 address (10.1.1.1). this complexity could confuse CGI program
writers and could open up vulnerability if CGI program uses
$REMOTE_ADDR for authentication.
solution: do not accept IPv4 traffic by using AF_INET6 socket. use
AF_INET socket (http server should listen to AF_INET and AF_INET6
socket explicitly). draft-cmetz-v6ops-v4mapped-api-harmful-01.txt
talks more about this issue.
itojun
