CWE-350Reliance on Reverse DNS Resolution for a Security-Critical Action

Description

The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.

[object Object]

Common consequences

• Access Control→Gain Privileges or Assume Identity,Bypass Protection Mechanism
  Malicious users can fake authentication information by providing false DNS information.

Potential mitigations

• Architecture and Design
  Use other means of identity verification that cannot be simply spoofed. Possibilities include a username/password or certificate.
• Implementation
  Perform proper forward and reverse DNS lookups to detect DNS spoofing.

Related CWEs

Recent CVEs classified under this CWE