Re: IQ Handling vulnerabilities

On 2/6/14, 3:06 PM, Philipp Hancke wrote:
> Am 06.02.2014 12:26, schrieb Kevin Smith:
>> Hi folks,
>>    Discussion in the XSF and at the recent XMPP Summit has shown that
>> there are widespread issues with handling of iq responses in XMPP
>> software. This is probably something we need to consider handling.
>
> This is something the WG should do.

Agreed.

>> The basis of this is that many libraries/clients
>> a) Only check the id of an iq error/result, not the sender, to check
>> it matches one they've sent (Very Wrong)
>
> Well, http://xmpp.org/rfcs/rfc6120.html#stanzas-semantics-iq says
>      the interaction is tracked by the requesting entity through use
>      of the 'id' attribute.
> That's easy to to get wrong :-/

I'd say that the text there is descriptive, not prescriptive. The new 
I-D (to update 6120 and then be incorporated into 6120bis) would define 
acceptable behavior from a security point of view.

>> b) Use predictably generated ids for stanzas (ill-advised, but not
>> strictly wrong)
>
> We need to fix the advice given in
> http://xmpp.org/rfcs/rfc6120.html#stanzas-attributes-id

Yes, that too - probably we'd want to say that 'id' values ought to be 
random (e.g., UUIDs).

Who's volunteering to write this up? Maybe Thijs?

Peter

-- 
Peter Saint-Andre
https://stpeter.im/