Secunia

Various techniques have been identified to use DNS to perform Cross Site Scripting and to spoof an IP address in web server log files and log analysers.

It is required that the web server or log analyser has been configured to perform reverse DNS lookups.

The problem is that various software will accept any answer from the DNS server. If the DNS server replies with a hostname that looks like an IP address ie. "192.168.12.5" then it would appear as a legit IP address, when in fact the real IP address was something completely different.

Apache allows this kind of injection into access logs. Any errors recorded in the error log would contain the real IP address.

iPlanet allows spoofing of IP addresses using this technique. It was also possible to completely hide requests.

WebTrends, Surfstats and Webexpert has been found vulnerable to Cross Site Scripting using a similar technique. By returning a hostname that contains a malicious client side script it is possible to perform Cross Site Scripting.

Furthermore, Logan Pro and Webexpert has been found vulnerable to an older Cross Site Scripting issue, by not verifying the User Agent parameter, this allows malicious users to inject client side scripts.

Solution
We recommend that you disable reverse lookup for your web server, to make sure that visitors leave useful data in your log files.
Further details available in Customer Area

Provided and/or discovered by
Hugo Vázquez Caramés & Toni Cortés Martínez

Changelog
Further details available in Customer Area

Deep Links
Links available in Customer Area