[xmpp] IQ Handling vulnerabilities

[Kevin Smith <[e-mail]>]

Hi folks,
  Discussion in the XSF and at the recent XMPP Summit has shown that
there are widespread issues with handling of iq responses in XMPP
software. This is probably something we need to consider handling.

The basis of this is that many libraries/clients
a) Only check the id of an iq error/result, not the sender, to check
it matches one they've sent (Very Wrong)
b) Use predictably generated ids for stanzas (ill-advised, but not
strictly wrong)
c) Use known resource strings (bad, but not strictly wrong)

In conjunction, this leads to various obvious attacks with differing
levels of severity, but for the sake of enumerating some, with some
good fortune with timing against a vulnerable client you can: Fake
contacts', or even their own, vcards; fake their roster so they think
people have 'unfriended' them, or that they have already added someone
unknown; deny capabilities discovery; make them think their server
doesn't have a MUC service; and the list goes on and on.

We certainly need to call this out explicitly in 3920ter, We might
want to publish something in the interim.

/K