Re: [xmpp] IQ Handling vulnerabilities

Philipp Hancke <fippo@goodadvice.pages.de> Thu, 06 February 2014 22:07 UTC

Return-Path: <fippo@goodadvice.pages.de>
X-Original-To: xmpp@ietfa.amsl.com
Delivered-To: xmpp@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2F3D81A03D4 for <xmpp@ietfa.amsl.com>; Thu, 6 Feb 2014 14:07:08 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.901
X-Spam-Level:
X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HtJwEA5wmlxG for <xmpp@ietfa.amsl.com>; Thu, 6 Feb 2014 14:07:05 -0800 (PST)
Received: from lo.psyced.org (lost.IN.psyced.org [188.40.42.221]) by ietfa.amsl.com (Postfix) with ESMTP id A8DAF1A0427 for <xmpp@ietf.org>; Thu, 6 Feb 2014 14:07:04 -0800 (PST)
Received: from [192.168.2.101] (p54970268.dip0.t-ipconnect.de [84.151.2.104]) (authenticated bits=0) by lo.psyced.org (8.14.3/8.14.3/Debian-9.4) with ESMTP id s16M71pu020811 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES128-SHA bits=128 verify=NO) for <xmpp@ietf.org>; Thu, 6 Feb 2014 23:07:03 +0100
Message-ID: <52F4077E.4010607@goodadvice.pages.de>
Date: Thu, 06 Feb 2014 23:06:54 +0100
From: Philipp Hancke <fippo@goodadvice.pages.de>
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Thunderbird/24.3.0
MIME-Version: 1.0
To: xmpp@ietf.org
References: <CAOb_FnxS-dMT85N7LHj5M9JWk3pL85=ugrDqaT7j5d28HBr0Cw@mail.gmail.com>
In-Reply-To: <CAOb_FnxS-dMT85N7LHj5M9JWk3pL85=ugrDqaT7j5d28HBr0Cw@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [xmpp] IQ Handling vulnerabilities
X-BeenThere: xmpp@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: XMPP Working Group <xmpp.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/xmpp>, <mailto:xmpp-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/xmpp/>
List-Post: <mailto:xmpp@ietf.org>
List-Help: <mailto:xmpp-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/xmpp>, <mailto:xmpp-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 06 Feb 2014 22:07:08 -0000

Am 06.02.2014 12:26, schrieb Kevin Smith:
> Hi folks,
>    Discussion in the XSF and at the recent XMPP Summit has shown that
> there are widespread issues with handling of iq responses in XMPP
> software. This is probably something we need to consider handling.

This is something the WG should do.

> The basis of this is that many libraries/clients
> a) Only check the id of an iq error/result, not the sender, to check
> it matches one they've sent (Very Wrong)

Well, http://xmpp.org/rfcs/rfc6120.html#stanzas-semantics-iq says
	the interaction is tracked by the requesting entity through use
	of the 'id' attribute.
That's easy to to get wrong :-/

> b) Use predictably generated ids for stanzas (ill-advised, but not
> strictly wrong)

We need to fix the advice given in
http://xmpp.org/rfcs/rfc6120.html#stanzas-attributes-id