Re: [TLS] [pkix] New version of Multiple OCSP mode of Certificate

[Martin Rex <[e-mail]>]

Marsh Ray wrote:
> 
> For example, is this outbound connection willing to authenticate with 
> the credentials of the user? Nearly every form of user credentials have 
> turned out to be forwardable in one way or another.

Possible problems;+

That crafted AIA-request could potentially "leak" information,
including sensitive information through a protocol of the attackers
choice to a target of the attackers choice (cookies, other
http-header-field contents, http-refererrers, basic authentication
credentials).


That crafted AIA-request could be accessing resources that are not
accessible to the attacker himself with a protocol of the attackers choice
and result in reaction that help the attacker in carrying out a more
complex attack (like opening ports on a NAT-style firewall).


That crafted AIA-request could potentially reuse existing credentials
or single sign-on information for a normally internal/trusted resource
with attacker-supplied URL arguments (cookie-based, rfc-4559-based
or client-certificate-based).


Even when the crafted AIA-request access resouces on some external
resouce (originally accessible to the attacker), the attacker might
entice the lighthearted AIA-follower to employ any kind of locally
available credentials by first playing DNS tricks on the client.
How safe is the installed base to inappropriate glue records
on _valid_ DNS lookup/responses -- something that should be doable
as a side effect of HTTP-redirects or multiple URLs with initial
failure of attacker-supplied AIA URIs?


-Martin