Subject: XML exploits

From: wayne <[email-masked]>
Date: Tue, 15 Jun 2004 13:26:08 -0500

In the overtime part of the Jabber session yesterday, Andy asked a
good question:

    Has anybody ever known of an exploit that targeted a vulnerability
    in the XML spec?

When no one answered, Jim Lyon responded " Andy, you should take that
as a resounding no."

Now there is a problem here folks.  When I first started getting
interested in designated sender systems (before SPF was even started),
I investigated the security issues of DNS, IP spoofing and SMTP.  I've
investigated them several times since then.  There *are* problems of
various forms will all of those systems, but none that I think are
critical to SPF.  However, I could easily have answered questions
similar to what Andy asked about the proposals I'm involved in.

Now, a quick check of bugtraq finds the following XML related
problems:

Microsoft Internet Explorer XML Parsing Denial Of Service
Vulnerability
remote 	Yes
published 	May 10, 2004
http://www.securityfocus.com/bid/10318

This is *exactly* the type of problem that mail admins are to justify
not wanting anything to do with XML on their mail servers.  They are
already under enough DoS attacks, thank you very much.

Multiple Vendor XML DTD Parameter Entity SOAP Server Denial Of Service
Vulnerability
remote 	Yes
published 	Dec 11, 2003

Microsoft Internet Explorer XML Object Zone Restriction Bypass
Vulnerability
remote 	Yes
published 	Nov 11, 2003

Sun Java XML Document Nested Entity Denial Of Service Vulnerability
remote 	No
published 	Sep 22, 2003

The list goes on, and that is only the very first source that I
checked.

Ok, now, I'm bothered.  Why didn't Jim or Harry immediately mention
such known security with XML.   Yes, they are likely not problems any
longer, but then neither are the DNS/IP-spoofing/SMTP problems that I
can name.

I've never claimed to be an XML expert.  When I ask questions about
it, I do so in order to learn about stuff.  Stuff that I think is
important to know.

Ok, for those who know more about XML than I do, can you give me an
example of where XML has been put into as hostile an environment as
anti-forgery/phishing SMTP?  Where so many different platforms will
need to be able to safely deal with XML documents from malicious
users?

-wayne

---

From: Marshall Rose <[email-masked]>
Date: Tue, 15 Jun 2004 14:33:54 -0700

some might think it odd that i, as co-chair responsible for process, 
would respond to this email; however, a careful reading between the 
lines will inform the thoughtful reader as to why this reply is 
appropriate.

> longer, but then neither are the DNS/IP-spoofing/SMTP problems that I

i wouldn't claim to be an XML expert, though i've been deploying 
xml-based code for five years this month.

however, i know a few things about phrasing an argument. there are 
certain things which are unprovable, such as trying to prove a 
negative. i also know a few things about fear, uncertainty, and doubt, 
and how to use them in trying to advance a position.

it isn't clear to me that the particular exploits you mention are 
xml-specific or specific to a particular implementation.

i think that a carefully written implementation of an xml-parser is 
likely to be resilient to all kinds of malicious nonsense; similarly, i 
think that an implementation that isn't carefully written can have 
problems.

i think i can

	s/xml/current spf syntax/g

and get the same truth value for the statement above. certainly i can

	s/xml/ber/g

and get the same truth value, although in that case it took about 8 
years before exploits started showing up.

the underlying assumption is that things have to be provably perfect in 
order to proceed. certainly spf isn't provably perfect. far, far from 
it. certainly caller-id isn't provably perfect. neither is xml. though 
each of the three exhibit a certain elegance in their own way.

however, the assumption is flawed because while theorists may be 
interested in provably perfect systems, experienced practitioners are 
not.

/mtr

---

From: wayne <[email-masked]>
Date: Wed, 16 Jun 2004 07:30:17 -0500

> lines will inform the thoughtful reader as to why this reply is

Marshall, when I first read your reply, I thought you might be
agreeing with me since I agreed with almost everything you said.
However, I think you have actually read stuff into my message that
just isn't there.

> and how to use them in trying to advance a position.

Correct.  And the failure of people who are not XML experts to answer
a question without research is not proof that a problem doesn't exist.

> xml-specific or specific to a particular implementation.

Completely irrelevant.  What is important is whether there are enough
exploits for mail admins to object to having XML on their servers.

> likely to be resilient to all kinds of malicious nonsense; similarly,
> i think that an implementation that isn't carefully written can have
> problems.
>
> i think i can
>

Yes, but remember that the current XML syntax requires a *complete*
SPF syntax parser in addition to an XML parser.  

> the underlying assumption is that things have to be provably perfect
> in order to proceed. certainly spf isn't provably perfect. far, far
> from it. certainly caller-id isn't provably perfect. neither is
> xml. though each of the three exhibit a certain elegance in their own
> way.

I never said that I wanted something that is provably perfect and I
never implied it.

We are trying to engineer a solution here.  We aren't supposed to be
some debating club where if you don't have a rebuttal card prepared
the other side scores a point.  We aren't even supposed to have sides
here. 

What I expect in order to make engineering decisions, and what Jim
Lyon didn't provide, is the provide the security background required
by RFC3552.  Since Jim is an RFC author, Jim is already supposed to
have done this research and disclosed all known security issues.  When
I answer a question raised by your co-chair that went unanswered, I
don't think the dismissive attitude toward XML security issues that
both Jim and you have displayed is appropriate.

-wayne

---

From: "Michael R. Brumm" <[email-masked]>
Date: Wed, 16 Jun 2004 12:59:22 -0600

>interested in provably perfect systems, experienced practitioners are 

The debating technique of turning the opposition's statement into an absurd absolute can be found in the book "Dilbert and the Way of the Weasel". A good read (and no, I'm not implying anyone here is a weasel).

The argument was never this absurd absolute:
 XML-syntax has exploits, SPF-syntax can never have exploits. Therefore, we should use SPF because we want a perfect system.

It was:
 XML-syntax, because it is more complicated, is more likely to have exploits. Several XML exploits are already known on multiple platforms. SPF-syntax is much, much simpler, and thus is less likely to have exploits. Therefore, SPF is preferable because we want a system which is less likely to have exploits.

Michael R. Brumm