Re: [secdir] secdir review of draft-ietf-webdav-bind-23

[Julian Reschke <[e-mail]>]

Hi Tero,

Tero Kivinen wrote:
> I have reviewed this document as part of the security directorate's 
> ongoing effort to review all IETF documents being processed by the 
> IESG.  These comments were written primarily for the benefit of the 
> security area directors.  Document editors and WG chairs should treat 
> these comments just like any other last call comments.
> 
> This document adds binding extensions to the WebDAV. Binding
> extensions seem to be like hard links on unix file system i.e.
> providing multiple bindings for same resource (and resource is freed
> only when the last binding goes away).
> 
> Security considerations section refers to the "HTTP/1.1 and the WebDAV
> Distributed Authoring Protocol specification" and says that all
> security considerations of them also applies to this document, but it
> does not give explicit references to the documents containing those
> security considerations.
> ...

I have fixed this in my copy of the draft; see 
<http://www.webdav.org/bind/draft-ietf-webdav-bind-latest.html#rfc.issue.sec-cons-references>. 
We can either produce a new draft after IESG review, or let this change 
wait until AUTH48.

(My personal preference is to provide the RFC Editor with a draft that 
has as few pending changes as possible).

> Bindings adds some new security concerns (privacy, loops, denial of
> service etc.), and those issues seem to be adequately covered by the
> security considerations section.
> 
> One of the things I am not sure if it is really applicable here, but
> which is not covered by the security considerations section is that
> bindings might confuse administrator about access permissions. I.e.
> even when administrator revokes all change permissions from certain
> collection (i.e the user cannot change the data any more), if that
> collection has binding pointing to some other collection or resource
> where user still has permissions, the user might still be able to
> change resources in the first collection even when administrator
> believes he already removed permissions.
> 
> I am not familiar enough with the WebDAV authorization model to know
> if this kind of attacks are possible or not, i.e. I do not know if the
> permissions are set per resource basis or for per collection or what.

RFC 3744 (WebDAV ACLs) defines access privileges per resource, not per 
URI (see also 
<http://www.webdav.org/bind/draft-ietf-webdav-bind-24.html#rfc.section.9> 
and <http://greenbytes.de/tech/webdav/rfc3744.html#rfc.section.5.p.2>).

Best regards, Julian

-- 
<green/>bytes GmbH, Hafenweg 16, D-48155 Münster, Germany
Amtsgericht Münster: HRB5782