Subject: [secdir] secdir review of draft-ietf-webdav-bind-23

From: Tero Kivinen <[email-masked]>
Date: Tue, 2 Jun 2009 13:52:31 +0300

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the 
IESG.  These comments were written primarily for the benefit of the 
security area directors.  Document editors and WG chairs should treat 
these comments just like any other last call comments.

This document adds binding extensions to the WebDAV. Binding
extensions seem to be like hard links on unix file system i.e.
providing multiple bindings for same resource (and resource is freed
only when the last binding goes away).

Security considerations section refers to the "HTTP/1.1 and the WebDAV
Distributed Authoring Protocol specification" and says that all
security considerations of them also applies to this document, but it
does not give explicit references to the documents containing those
security considerations.

Bindings adds some new security concerns (privacy, loops, denial of
service etc.), and those issues seem to be adequately covered by the
security considerations section.

One of the things I am not sure if it is really applicable here, but
which is not covered by the security considerations section is that
bindings might confuse administrator about access permissions. I.e.
even when administrator revokes all change permissions from certain
collection (i.e the user cannot change the data any more), if that
collection has binding pointing to some other collection or resource
where user still has permissions, the user might still be able to
change resources in the first collection even when administrator
believes he already removed permissions.

I am not familiar enough with the WebDAV authorization model to know
if this kind of attacks are possible or not, i.e. I do not know if the
permissions are set per resource basis or for per collection or what.
-- 
[email-masked]

---

From: Julian Reschke <[email-masked]>
Date: Tue, 02 Jun 2009 14:26:12 +0200

Hi Tero,

Tero Kivinen wrote:
> ...

I have fixed this in my copy of the draft; see 
<http://www.webdav.org/bind/draft-ietf-webdav-bind-latest.html#rfc.issue.sec-cons-references>. 
We can either produce a new draft after IESG review, or let this change 
wait until AUTH48.

(My personal preference is to provide the RFC Editor with a draft that 
has as few pending changes as possible).

> permissions are set per resource basis or for per collection or what.

RFC 3744 (WebDAV ACLs) defines access privileges per resource, not per 
URI (see also 
<http://www.webdav.org/bind/draft-ietf-webdav-bind-24.html#rfc.section.9> 
and <http://greenbytes.de/tech/webdav/rfc3744.html#rfc.section.5.p.2>).

Best regards, Julian

-- 
<green/>bytes GmbH, Hafenweg 16, D-48155 Münster, Germany
Amtsgericht Münster: HRB5782

---

From: Tero Kivinen <[email-masked]>
Date: Tue, 2 Jun 2009 15:32:03 +0300

> <http://www.webdav.org/bind/draft-ietf-webdav-bind-latest.html#rfc.issue.sec-cons-references>. 

That seems to be ok.

> We can either produce a new draft after IESG review, or let this change 

Either one is ok for me...

> and <http://greenbytes.de/tech/webdav/rfc3744.html#rfc.section.5.p.2>).

Ok, that should make it clear as then bindings do not affect access
privileges. 
-- 
[email-masked]