CVE-2002-0804

An attacker who controls reverse DNS for their IP address can set the hostname to match the hostname of a victim user. When Bugzilla performs IP checks against the `logincookies` table, it compares the attacker's spoofed hostname instead of the actual IP address, allowing the attacker to impersonate the victim and bypass IP-based access restrictions [ref_id=1]. This attack only works if the web server has reverse DNS lookups enabled (disabled by default in Apache).

The `logincookies` table stored a `hostname` field populated from the web server's `REMOTE_HOST` environment variable, which is obtained via reverse DNS lookup. The fix changes this field to store the IP address (`ipaddr`) instead of the hostname, and invalidates all existing logincookie entries during upgrade to prevent spoofed hostnames from being accepted.

The patch changes the `logincookies` table to store the client's IP address (`ipaddr`) instead of the reverse-DNS-resolved hostname. This eliminates the attack vector because the IP address is obtained directly from the TCP connection (`REMOTE_ADDR`) and cannot be spoofed by the attacker's DNS configuration. All existing logincookie entries are deleted during upgrade to ensure no stale hostname-based entries remain valid [ref_id=1].