The fact that IP addresses can be spoofed is a fact due to the design of the IP protocol But not necessarily is going to be a vulnerability, if for example on the application level i question the truthfullness of the sender address, it is not a problem anymore.
The simple TCP three way handshake, having randomizing SEQ numbers, offer a protection against IP spoofing, in fact if the attacker does not get the SYN+ACK packet, he cannot begin a connection.