Subject: Re: [BXXPwg] you asked for outstanding issues?

From: j h woodyatt <[email-masked]>
Date: Fri, 23 Feb 2001 15:31:25 -0800

On Friday, February 23, 2001, at 01:28  PM, Darren New wrote:
> j h woodyatt wrote:
>> I think it would be worth documenting the steps necessary to keep a 
>> BEEP
>> listener from behaving poorly in the face of actively hostile
>> initiators.  For example, there's a fairly amusing denial-of-service
>> attack I've devised.
>
> But that only denies the service to the session that's doing that, 
> right? I
> mean, why is this more a denial of service than simply opening the
> connection and not sending anything?
> [...]
> Aren't they all basically run-out-of-memory or run-off-the-buffer 
> concerns,
> tho?

Yeah, but this one has the potential to be very destructive if the BEEP 
listener is implemented improperly.

For the example I gave, if the listener gives buffer space to channel 
zero after feeding each frame of a message into its XML parser (sending 
SEQ frames as suggested by the TCP mapping document), then what happens?

If your XML parser is Expat, and you aren't careful, the buffer 
containing the 'uri' attribute accumulates the received characters until 
there is no memory left, or until the sender eventually declines your 
SEQ invitations to send more data.

If the BEEP listener manages multiple sessions inside the same process 
space, then one anonymous untraced initiator can crash all the sessions 
managed by the listener-- maybe it can even crash the entire host by 
making it thrash to death.  Distributed attacks aren't necessary.

Another delightful attack is to keep sending CDATA content in a <start>, 
<profile>, <close> or <error> message, without ever sending the end tag 
for the message.  Which makes me, as an implementer, ask the following 
question: how much buffer space should I give to channel zero for 
receiving <profile> elements?  (Take into consideration that <profile> 
elements may or may not have CDATA content, depending on the profile.  
Note: there is no size limit imposed by the BEEP core on those CDATA 
parts.)

There are reasonable precautions implementers should take to prevent 
such simple service denial attacks from being so wildly successful.  Are 
we collecting it?  Where?

--
j h woodyatt <[email-masked]>
"And the difference between the CIA and
a religious cult is... what, again?" --drieux

_______________________________________________
BXXPwg mailing list
[email-masked]
http://lists.invisible.net/mailman/listinfo/bxxpwg

---

From: Gabe Wachob <[email-masked]>
Date: Fri, 23 Feb 2001 15:38:53 -0800 (PST)

As an implementor, collecting these sort of issues would be helpful. I'm
not sure that these sort of issues have been discussed on this list at all
before. I know that I have not had many of these issues in mind when
working on the Python implementation. I have focused on spec compliance.

	-Gabe