Description

This attack-focused weakness is caused by improperly implemented authentication schemes that are subject to spoofing attacks.

Applicable Platforms
None

Time Of Introduction

• Architecture and Design
• Implementation

Related Attack Patterns

• CAPEC-21
• CAPEC-22
• CAPEC-459
• CAPEC-461
• CAPEC-59
• CAPEC-60
• CAPEC-94

Common Consequences

Detection Methods
None

Potential Mitigations
None

Relationships
This can be resultant from insufficient verification.

Demonstrative Examples   (Details)

1. Both of these examples check if a request is from a trusted address before responding to the request. (Demonstrative Example Id DX-99)
2. Here, an authentication mechanism implemented in Java relies on an IP address for source validation. If an attacker is able to spoof the IP, however, he may be able to bypass such an authentication mechanism.
3. The following code samples use a DNS lookup in order to decide whether or not an inbound request is from a trusted host. If an attacker can poison the DNS cache, they can gain trusted status. (Demonstrative Example Id DX-93)

Observed Examples

1. CVE-2009-1048 : VOIP product allows authentication bypass using 127.0.0.1 in the Host header.

White Box Definitions
None

Black Box Definitions
None

Taxynomy Mappings

References:

1. Mark Dowd John McDonald Justin Schuh .The Art of Software Security Assessment 1st Edition. Addison Wesley. Section:'Chapter 3, "Spoofing and Identification", Page 72.'. Published on 2006.