Re: [TLS] TLS renegotiation issue

[Florian Weimer <fweimer at bfk.de>]

* Michael D'Errico:

> Excerpt from the PDF:
>
>> char *req =
>>   "GET /highsecurity/index.html HTTP/1.1\r\n"
>>   "Host: example.com\r\n"
>>   "Connection: keep-alive\r\n"
>>   "\r\n"
>>   "GET /evil/doEvil.php?evilStuff=here HTTP/1.1\r\n"
>>   "Host: example.com\r\n"
>>   "Connection: close\r\n"
>>   "X-ignore-what-comes-next: ";
>
> The attack works because the last line is unterminated to effectively
> comment out the client's GET request.
>
> A possible counter to this attack is for the client to send two
> CRLF's prior to its actual request.  This will separate the evil
> request from the actual one containing the Cookie.

It's very hard to tell if this plugs the vulnerability in all cases.
I've written web applications which use an server-internal atemporal
request to access future authentication information.  While that might
seem naive in retrospect, it was the recommended way of adding client
certificate authentication without introducing additional round-trips,
so I'm probably not the only one who did that.  These applications
will likely remain vulnerable if you confine splicing to HTTP request
message boundaries.

-- 
Florian Weimer                <fweimer at bfk.de>
BFK edv-consulting GmbH       http://www.bfk.de/
Kriegsstraße 100              tel: +49-721-96201-1
D-76133 Karlsruhe             fax: +49-721-96201-99