Re: IQ Handling vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 2/6/14, 2:58 PM, Joe Hildebrand (jhildebr) wrote:
> (as individual)
> 
> I think this is a very important issue.  I'm worried about the
> security impact, and I think we need to give good guidance.
> 
> (as co-chair)
> 
> Who else thinks we need to work on this?
> 
> Can we start with an individual I-D that lays out the problem and 
> solution?  That would allow us to make good decisions about what
> the next step would be.  Kev, that might be pretty quick for you to
> write...
> 
> 
> 
> On 2/6/14 3:26 AM, "Kevin Smith" <[email protected]> wrote:
> 
>> Hi folks, Discussion in the XSF and at the recent XMPP Summit has
>> shown that there are widespread issues with handling of iq
>> responses in XMPP software. This is probably something we need to
>> consider handling.
>> 
>> The basis of this is that many libraries/clients a) Only check
>> the id of an iq error/result, not the sender, to check it matches
>> one they've sent (Very Wrong) b) Use predictably generated ids
>> for stanzas (ill-advised, but not strictly wrong) c) Use known
>> resource strings (bad, but not strictly wrong)
>> 
>> In conjunction, this leads to various obvious attacks with
>> differing levels of severity, but for the sake of enumerating
>> some, with some good fortune with timing against a vulnerable
>> client you can: Fake contacts', or even their own, vcards; fake
>> their roster so they think people have 'unfriended' them, or that
>> they have already added someone unknown; deny capabilities
>> discovery; make them think their server doesn't have a MUC
>> service; and the list goes on and on.
>> 
>> We certainly need to call this out explicitly in 3920ter, We
>> might want to publish something in the interim.
>> 
>> /K _______________________________________________ xmpp mailing
>> list [email protected] https://www.ietf.org/mailman/listinfo/xmpp
>> 
> 
> 

I agree this is an important issue that needs to be addressed.  I
think someone submitting an I-D is a fine starting point.


- -- 
- - m&m

Matt Miller < [email protected] >
Cisco Systems, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
Comment: GPGTools - https://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBCgAGBQJS9Ak+AAoJEDWi+S0W7cO17IgH/2XbPvHedoSvsOY0L/LEcvu6
cfeDRy7ErMMgp+Evb6UTSCETNm20WYTUEsYGVigUV02HsV5GhJFswtrr+vk5hG3n
uF94GmTCRSTTbn0CIbCfgwq5bDJrtRbi0DkpzPP1ZD7t1QZaFjhi39t6XjGc3u9d
hkKvG/XS2bB/C+71X9jYEeReEMZdUc/bXgwTCTzD84GVVMIK0QisfJBQw6o6blXI
03FzvSn8qwZiQ3YBhrPNndKflFv0uRU4mOO9N/SYXpJjtMmqu2i6wA1v5rvct3H9
EnoMz03GZ0xxZDo07aBqHjCivAji9AKZ+Dpgw+sBM6H2X8OIdONM0L823qIEuTI=
=2sJN
-----END PGP SIGNATURE-----