Subject: [AAA-WG]: Issue 374: CMS cut and paste attack

From: Bernard Aboba <[email-masked]>
Date: Wed, 16 Oct 2002 06:49:41 -0700 (PDT)

Issue 374: CMS cut and paste attack
Submitter name: Jari Arkko
Submitter email address: [email-masked]
Date first submitted: 11/15/2002
Document: draft-ietf-aaa-diameter-cms-sec-04.txt
Comment type: T
Priority: S
Section: several
Rationale/Explanation of issue:

I think that the CMS application, when ready, should include the command
code and other stuff from the header (otherwise you'll see attacks where
you have the same protected AVPs, but replace resource allocation request
with accounting request etc). As this text in the CMS application is being
developed, we could take care of not including the D bit there.