Subject: Re: [Sip] SIP WG - 5 - Last Call Open Discussion - draft-ietf-sip-refer-02.txt

From: William Marshall <[email-masked]>
Date: Thu, 27 Dec 2001 11:50:09 -0500 (EST)

I don't believe there has been any conclusion posted about security
aspects of the Referred-By header, which I raised as issues in my
initial review of this draft.

Without an adequate mechanism to verify the information in the Referred-By
header, and to verify the timeliness of that information, the header is
worse than useless.  It should be removed from the draft.

To repeat the problem, consider three parties, A, B, and C, where
A sends a REFER to B, causing B to send an INVITE to C.  Procedures
exist whereby B can authenticate A; procedures also exist whereby
C can authenticate B.  

However, nothing prevents B from including a bogus Referred-By header 
in its INVITE request to C.  Nothing prevents B from including a
previously-valid-but-expired Referred-By header in its INVITE (i.e. 
a form of replay attack).  Anything done by C based on information
in the Referred-By header may be incorrect or harmful.

Bill Marshall
[email-masked]

_______________________________________________
Sip mailing list  http://www1.ietf.org/mailman/listinfo/sip
This list is for NEW development of the core SIP Protocol
Use [email-masked] for questions on current sip
Use [email-masked] for new developments on the application of sip

---

From: Michael Thomas <[email-masked]>
Date: Fri, 28 Dec 2001 15:47:30 -0800 (PST)

> in the Referred-By header may be incorrect or harmful.

Bill,

Are there real life threats which would cause C to
act in a harmful manner? I mean, I understand the
potential for attack, but I guess I wonder whether
there's anything *really* serious that could be
abused here. It seems to me that it might be able
defeat screening, but how serious a problem is
that? We currently don't have a way to
authenticate RPI either, and though we intend to
get around to fixing that eventually, it doesn't
seem to be a burning need. Also: is this something
that really needs to be dealt with by the refer
draft? Could it, say, be dealt with as a
requirement for SIP security?

		Mike