Talk:Inter-protocol exploitation

From Wikipedia, the free encyclopedia
Jump to: navigation, search
WikiProject Computer Security / Computing   
WikiProject icon This article is within the scope of WikiProject Computer Security, a collaborative effort to improve the coverage of computer security on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks.
 ???  This article has not yet received a rating on the project's quality scale.
 ???  This article has not yet received a rating on the project's importance scale.
Taskforce icon
This article is supported by WikiProject Computing.
 
WikiProject Computing  
WikiProject icon This article is within the scope of WikiProject Computing, a collaborative effort to improve the coverage of computers, computing, and information technology on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks.
 ???  This article has not yet received a rating on the project's quality scale.
 ???  This article has not yet received a rating on the project's importance scale.
 

Not newly discovered[edit]

How is this a new class of attacks as of 2007? Examples of the same class were described in the security considerations of RFC 1738, from December 1994:

A URL-related security threat is that it is sometimes possible to construct a URL such that an attempt to perform a harmless idempotent operation such as the retrieval of the object will in fact cause a possibly damaging remote operation to occur. The unsafe URL is typically constructed by specifying a port number other than that reserved for the network protocol in question. The client unwittingly contacts a server which is in fact running a different protocol. The content of the URL contains instructions which when interpreted according to this other protocol cause an unexpected operation. An example has been the use of gopher URLs to cause a rude message to be sent via a SMTP server. Caution should be used when using any URL which specifies a port number other than the default for the protocol, especially when it is a number within the reserved space.
Care should be taken when URLs contain embedded encoded delimiters for a given protocol (for example, CR and LF characters for telnet protocols) that these are not unencoded before transmission. This would violate the protocol but could be used to simulate an extra operation or parameter, again causing an unexpected and possible harmful remote operation to be performed.

This motivated restrictions on which ports can be connected to via HTTP, that are still present in current browsers (although since the restricted ports were a blacklist, it was always obvious that there was the potential for more such attacks). Also, browser support for APIs such as XMLHttpRequest has increased the degree of control that an attacker has over the carrier request, but that's not a fundamental difference.

I'm not saying this class of attacks is not important, but there is no justification for describing it as newly discovered. --David-Sarah Hopwood ⚥ (talk) 04:01, 31 October 2009 (UTC)

Also note that FTP bounce attacks could be used for inter-protocol exploits (known since 1996). --David-Sarah Hopwood ⚥ (talk) 05:35, 1 November 2009 (UTC)