Re: IQ Handling vulnerabilities

(as individual)

I think this is a very important issue.  I'm worried about the security
impact, and I think we need to give good guidance.

(as co-chair)

Who else thinks we need to work on this?

Can we start with an individual I-D that lays out the problem and
solution?  That would allow us to make good decisions about what the next
step would be.  Kev, that might be pretty quick for you to write...



On 2/6/14 3:26 AM, "Kevin Smith" <[email protected]> wrote:

>Hi folks,
>  Discussion in the XSF and at the recent XMPP Summit has shown that
>there are widespread issues with handling of iq responses in XMPP
>software. This is probably something we need to consider handling.
>
>The basis of this is that many libraries/clients
>a) Only check the id of an iq error/result, not the sender, to check
>it matches one they've sent (Very Wrong)
>b) Use predictably generated ids for stanzas (ill-advised, but not
>strictly wrong)
>c) Use known resource strings (bad, but not strictly wrong)
>
>In conjunction, this leads to various obvious attacks with differing
>levels of severity, but for the sake of enumerating some, with some
>good fortune with timing against a vulnerable client you can: Fake
>contacts', or even their own, vcards; fake their roster so they think
>people have 'unfriended' them, or that they have already added someone
>unknown; deny capabilities discovery; make them think their server
>doesn't have a MUC service; and the list goes on and on.
>
>We certainly need to call this out explicitly in 3920ter, We might
>want to publish something in the interim.
>
>/K
>_______________________________________________
>xmpp mailing list
>[email protected]
>https://www.ietf.org/mailman/listinfo/xmpp
>


-- 
Joe Hildebrand