RE: Best practice for data encoding?

["David Harrington" <ietfdbh at comcast.net>]

Hi 

The security problems identified in
http://www.cert.org/advisories/CA-2002-03.html "Multiple
Vulnerabilities in Many Implementations of the Simple Network
Management Protocol (SNMP)" are not caused by the protocol choice to
use ASN.1, but by vendors incorrectly implementing the protocol (which
was made worse by vendors using toolkits that had the problems).

If "Multiple Vulnerabilities in Implementations" were used to condemn
the encoding methods of protocols that have been incorrectly
implemented, then we would have to condemn an awful lot of IETF
protocols as being very (security) bug prone: 

CERT Advisory CA-2003-26 Multiple Vulnerabilities in SSL/TLS
Implementations
US-CERT Vulnerability Note VU#459371 Multiple IPsec implementations do
not adequately validate
 CERTR Advisory CA-2001-18 Multiple Vulnerabilities in Several
Implementations of the Lightweight Directory Access Protocol (LDAP) 
CERT Advisory CA-2002-36 Multiple Vulnerabilities in SSH
Implementations
 CERTR Advisory CA-2003-06 Multiple vulnerabilities in implementations
of the Session Initiation Protocol (SIP) 
Vulnerability Note VU#428230 Multiple vulnerabilities in S/MIME
implementations
Vulnerability Note VU#955777 Multiple vulnerabilities in DNS
implementations
Vulnerability Note VU#226364 Multiple vulnerabilities in Internet Key
Exchange (IKE) version 1 implementations
CERTR Advisory CA-2002-06 Vulnerabilities in Various Implementations
of the RADIUS Protocol
CERTR Advisory CA-2000-06 Multiple Buffer Overflows in Kerberos
Authenticated Services
Vulnerability Note VU#836088 Multiple vendors' email content/virus
scanners do not adequately check "message/partial" MIME entities

David Harrington
dharrington at huawei.com 
dbharrington at comcast.net
ietfdbh at comcast.net


> -----Original Message-----
> From: Steven M. Bellovin [mailto:smb at cs.columbia.edu] 
> Sent: Monday, June 05, 2006 7:10 PM
> To: Randy Presuhn
> Cc: ietf at ietf.org
> Subject: Re: Best practice for data encoding?
> 
> On Mon, 5 Jun 2006 16:06:28 -0700, "Randy Presuhn"
> <randy_presuhn at mindspring.com> wrote:
> 
> > Hi -
> > 
> > > From: "Iljitsch van Beijnum" <iljitsch at muada.com>
> > > To: "IETF Discussion" <ietf at ietf.org>
> > > Sent: Monday, June 05, 2006 2:43 PM
> > > Subject: Best practice for data encoding?
> > ...
> > > Then there is the ASN.1 route, but as we can see with  
> > > SNMP, this also requires lots of code and is very (security) bug

> > > prone.
> > ...
> > 
> > Having worked on SNMP toolkits for a long time, I'd have to
> > strenuously disagree.  In my experience, the ASN.1/BER-related
> > code is a rather small portion of an SNMP protocol engine.
> > The code related to the SNMP protocol's quirks, such as 
> Get-Next/Bulk
> > processing and the mangling of index values into object
identifiers
> > (which is far removed from how ASN.1 intended object identifiers
> > to be used) require much more code and complexity.
> 
> Yah -- measure first, then optimize.
> 
> > 
> > I'm curious, too, about the claim that this has resulted in
security
> > problems.  Could someone elaborate?
> > 
> See http://www.cert.org/advisories/CA-2002-03.html
> 
> 
> 
> 		--Steven M. Bellovin, http://www.cs.columbia.edu/~smb
> 
> _______________________________________________
> Ietf mailing list
> Ietf at ietf.org
> https://www1.ietf.org/mailman/listinfo/ietf
> 


_______________________________________________
Ietf mailing list
Ietf at ietf.org
https://www1.ietf.org/mailman/listinfo/ietf