You are viewing a plain text version of this content. The canonical link for it is here.
Posted to fx-dev@ws.apache.org by "Gürkan Vural (JIRA)" <ji...@apache.org> on 2007/01/17 09:02:27 UTC
[jira] Created: (WSS-70) WSHandler checkReceiverResults causes
security problem
WSHandler checkReceiverResults causes security problem
------------------------------------------------------
Key: WSS-70
URL: https://issues.apache.org/jira/browse/WSS-70
Project: WSS4J
Issue Type: Bug
Reporter: Gürkan Vural
Assigned To: Davanum Srinivas
Priority: Critical
In WSS4J 1.1.0 in WSDoAllReceiver there is a check of security actions
which also checks the size of actions. However this part is moved in
WSS4J 1.5 to WSHandler.java using checkReceiverResults function and
action size check is commented out. However the checking for loop is
controled against the size of actions received in the SOAP message. This
cause a security problem when an empty security header is sent. It omits
the for loop and throws no exception!
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: https://issues.apache.org/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
[jira] Commented: (WSS-70) WSHandler checkReceiverResults causes
security problem
Posted by "Fred Dushin (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-70?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12569318#action_12569318 ]
Fred Dushin commented on WSS-70:
--------------------------------
"This is not issue if there is no security sent in the header because an exception will be thrown before this method gets called."
Unfortunately, this is an issue if an /empty/ security header is sent. The issue is that specified policies are not being enforced.
We are implementing a similar workaround in CXF (https://issues.apache.org/jira/browse/CXF-1433), until a fix for this is made. (Yes, I supposedly have karma, so I should be able to fix it
> WSHandler checkReceiverResults causes security problem
> ------------------------------------------------------
>
> Key: WSS-70
> URL: https://issues.apache.org/jira/browse/WSS-70
> Project: WSS4J
> Issue Type: Bug
> Reporter: Gürkan Vural
> Priority: Critical
>
> In WSS4J 1.1.0 in WSDoAllReceiver there is a check of security actions
> which also checks the size of actions. However this part is moved in
> WSS4J 1.5 to WSHandler.java using checkReceiverResults function and
> action size check is commented out. However the checking for loop is
> controled against the size of actions received in the SOAP message. This
> cause a security problem when an empty security header is sent. It omits
> the for loop and throws no exception!
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
[jira] Commented: (WSS-70) WSHandler checkReceiverResults causes
security problem
Posted by "Chad DeBauch (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-70?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12519713 ]
Chad DeBauch commented on WSS-70:
---------------------------------
I agree, this is major security hole with any handler that uses this method. The current release of Rampart v1.2 uses this method in WSDoAllReceiver, which is how I discovered the issue. There is two ways to approach this. Don't have the handlers use this method or fix this in wss4j. I use my own handler to get around this.
In my previous comment I said to simply uncomment but it really needs to look like this:
if (size != resultActions) {
return false;
}
> WSHandler checkReceiverResults causes security problem
> ------------------------------------------------------
>
> Key: WSS-70
> URL: https://issues.apache.org/jira/browse/WSS-70
> Project: WSS4J
> Issue Type: Bug
> Reporter: Gürkan Vural
> Assignee: Davanum Srinivas
> Priority: Critical
>
> In WSS4J 1.1.0 in WSDoAllReceiver there is a check of security actions
> which also checks the size of actions. However this part is moved in
> WSS4J 1.5 to WSHandler.java using checkReceiverResults function and
> action size check is commented out. However the checking for loop is
> controled against the size of actions received in the SOAP message. This
> cause a security problem when an empty security header is sent. It omits
> the for loop and throws no exception!
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
[jira] Commented: (WSS-70) WSHandler checkReceiverResults causes
security problem
Posted by "Gürkan Vural (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-70?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12519709 ]
Gürkan Vural commented on WSS-70:
---------------------------------
6 months has passed since I mentioned that issue. You can also test this issue by sending security headers with no action. No security headers will throw exception. But security headers with no action will be enough. This is suprising that nobody noticed this issue except you.
> WSHandler checkReceiverResults causes security problem
> ------------------------------------------------------
>
> Key: WSS-70
> URL: https://issues.apache.org/jira/browse/WSS-70
> Project: WSS4J
> Issue Type: Bug
> Reporter: Gürkan Vural
> Assignee: Davanum Srinivas
> Priority: Critical
>
> In WSS4J 1.1.0 in WSDoAllReceiver there is a check of security actions
> which also checks the size of actions. However this part is moved in
> WSS4J 1.5 to WSHandler.java using checkReceiverResults function and
> action size check is commented out. However the checking for loop is
> controled against the size of actions received in the SOAP message. This
> cause a security problem when an empty security header is sent. It omits
> the for loop and throws no exception!
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
[jira] Updated: (WSS-70) WSHandler checkReceiverResults causes
security problem
Posted by "Davanum Srinivas (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-70?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Davanum Srinivas updated WSS-70:
--------------------------------
Assignee: (was: Davanum Srinivas)
> WSHandler checkReceiverResults causes security problem
> ------------------------------------------------------
>
> Key: WSS-70
> URL: https://issues.apache.org/jira/browse/WSS-70
> Project: WSS4J
> Issue Type: Bug
> Reporter: Gürkan Vural
> Priority: Critical
>
> In WSS4J 1.1.0 in WSDoAllReceiver there is a check of security actions
> which also checks the size of actions. However this part is moved in
> WSS4J 1.5 to WSHandler.java using checkReceiverResults function and
> action size check is commented out. However the checking for loop is
> controled against the size of actions received in the SOAP message. This
> cause a security problem when an empty security header is sent. It omits
> the for loop and throws no exception!
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
[jira] Assigned: (WSS-70) WSHandler checkReceiverResults causes
security problem
Posted by "Fred Dushin (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-70?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Fred Dushin reassigned WSS-70:
------------------------------
Assignee: Fred Dushin
> WSHandler checkReceiverResults causes security problem
> ------------------------------------------------------
>
> Key: WSS-70
> URL: https://issues.apache.org/jira/browse/WSS-70
> Project: WSS4J
> Issue Type: Bug
> Reporter: Gürkan Vural
> Assignee: Fred Dushin
> Priority: Critical
> Attachments: wss4j_actions.patch
>
>
> In WSS4J 1.1.0 in WSDoAllReceiver there is a check of security actions
> which also checks the size of actions. However this part is moved in
> WSS4J 1.5 to WSHandler.java using checkReceiverResults function and
> action size check is commented out. However the checking for loop is
> controled against the size of actions received in the SOAP message. This
> cause a security problem when an empty security header is sent. It omits
> the for loop and throws no exception!
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
[jira] Commented: (WSS-70) WSHandler checkReceiverResults causes
security problem
Posted by "Chad DeBauch (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-70?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#action_12516402 ]
Chad DeBauch commented on WSS-70:
---------------------------------
This is not issue if there is no security sent in the header because an exception will be thrown before this method gets called.
That said there is a major security hole the way the method stands. If you have a service that requires UsernameToken and Digital Signature, and the client sends just UsernameToken the for loop in that method will only verify the UsernameToken and not check the Signature, thus by passing Digital Signature. I created a client and a service that proves this security hole.
The fix to this issue is simple just uncomment the the following code in the method:
// if (size != resultActions) {
// throw new AxisFault(
// "WSDoAllReceiver: security processing failed (actions number
// mismatch)");
// }
> WSHandler checkReceiverResults causes security problem
> ------------------------------------------------------
>
> Key: WSS-70
> URL: https://issues.apache.org/jira/browse/WSS-70
> Project: WSS4J
> Issue Type: Bug
> Reporter: Gürkan Vural
> Assignee: Davanum Srinivas
> Priority: Critical
>
> In WSS4J 1.1.0 in WSDoAllReceiver there is a check of security actions
> which also checks the size of actions. However this part is moved in
> WSS4J 1.5 to WSHandler.java using checkReceiverResults function and
> action size check is commented out. However the checking for loop is
> controled against the size of actions received in the SOAP message. This
> cause a security problem when an empty security header is sent. It omits
> the for loop and throws no exception!
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
Re: [jira] Updated: (WSS-70) WSHandler checkReceiverResults causes
security problem
Posted by Fred Dushin <fr...@dushin.net>.
This change is fine, as far as CXF is concerned. (In fact, it will
allow us to remove a workaround for it)
Could we get an Axis person to double check whether the fix is good
for Axis?
Thanks!
-Fred
On Feb 18, 2008, at 7:24 AM, Colm O hEigeartaigh (JIRA) wrote:
>
> [ https://issues.apache.org/jira/browse/WSS-70?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
> ]
>
> Colm O hEigeartaigh updated WSS-70:
> -----------------------------------
>
> Attachment: wss4j_actions.patch
>
>> WSHandler checkReceiverResults causes security problem
>> ------------------------------------------------------
>>
>> Key: WSS-70
>> URL: https://issues.apache.org/jira/browse/WSS-70
>> Project: WSS4J
>> Issue Type: Bug
>> Reporter: Gürkan Vural
>> Priority: Critical
>> Attachments: wss4j_actions.patch
>>
>>
>> In WSS4J 1.1.0 in WSDoAllReceiver there is a check of security
>> actions
>> which also checks the size of actions. However this part is moved in
>> WSS4J 1.5 to WSHandler.java using checkReceiverResults function and
>> action size check is commented out. However the checking for loop is
>> controled against the size of actions received in the SOAP message.
>> This
>> cause a security problem when an empty security header is sent. It
>> omits
>> the for loop and throws no exception!
>
> --
> This message is automatically generated by JIRA.
> -
> You can reply to this email to add a comment to the issue online.
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
> For additional commands, e-mail: wss4j-dev-help@ws.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
[jira] Updated: (WSS-70) WSHandler checkReceiverResults causes
security problem
Posted by "Colm O hEigeartaigh (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-70?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Colm O hEigeartaigh updated WSS-70:
-----------------------------------
Attachment: wss4j_actions.patch
> WSHandler checkReceiverResults causes security problem
> ------------------------------------------------------
>
> Key: WSS-70
> URL: https://issues.apache.org/jira/browse/WSS-70
> Project: WSS4J
> Issue Type: Bug
> Reporter: Gürkan Vural
> Priority: Critical
> Attachments: wss4j_actions.patch
>
>
> In WSS4J 1.1.0 in WSDoAllReceiver there is a check of security actions
> which also checks the size of actions. However this part is moved in
> WSS4J 1.5 to WSHandler.java using checkReceiverResults function and
> action size check is commented out. However the checking for loop is
> controled against the size of actions received in the SOAP message. This
> cause a security problem when an empty security header is sent. It omits
> the for loop and throws no exception!
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
[jira] Commented: (WSS-70) WSHandler checkReceiverResults causes
security problem
Posted by "Colm O hEigeartaigh (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-70?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12569873#action_12569873 ]
Colm O hEigeartaigh commented on WSS-70:
----------------------------------------
Please consider the attached patch to fix this problem.
The current checkReceiverResults algorithm works for the following cases:
wsResult.size() == actions.size()
wsResult.size() > actions.size()
It fails in the following scenarios:
wsResult.size < actions.size()
A simple patch is just to check after the for loop that:
if (ai != size) {
return false;
}
> WSHandler checkReceiverResults causes security problem
> ------------------------------------------------------
>
> Key: WSS-70
> URL: https://issues.apache.org/jira/browse/WSS-70
> Project: WSS4J
> Issue Type: Bug
> Reporter: Gürkan Vural
> Priority: Critical
>
> In WSS4J 1.1.0 in WSDoAllReceiver there is a check of security actions
> which also checks the size of actions. However this part is moved in
> WSS4J 1.5 to WSHandler.java using checkReceiverResults function and
> action size check is commented out. However the checking for loop is
> controled against the size of actions received in the SOAP message. This
> cause a security problem when an empty security header is sent. It omits
> the for loop and throws no exception!
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
[jira] Commented: (WSS-70) WSHandler checkReceiverResults causes
security problem
Posted by "Fred Dushin (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-70?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12587301#action_12587301 ]
Fred Dushin commented on WSS-70:
--------------------------------
I applied Colm's patch (an improvement over the workaround we use in CXF)
Thanks!
> WSHandler checkReceiverResults causes security problem
> ------------------------------------------------------
>
> Key: WSS-70
> URL: https://issues.apache.org/jira/browse/WSS-70
> Project: WSS4J
> Issue Type: Bug
> Reporter: Gürkan Vural
> Priority: Critical
> Attachments: wss4j_actions.patch
>
>
> In WSS4J 1.1.0 in WSDoAllReceiver there is a check of security actions
> which also checks the size of actions. However this part is moved in
> WSS4J 1.5 to WSHandler.java using checkReceiverResults function and
> action size check is commented out. However the checking for loop is
> controled against the size of actions received in the SOAP message. This
> cause a security problem when an empty security header is sent. It omits
> the for loop and throws no exception!
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org
[jira] Resolved: (WSS-70) WSHandler checkReceiverResults causes
security problem
Posted by "Fred Dushin (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/WSS-70?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Fred Dushin resolved WSS-70.
----------------------------
Resolution: Fixed
> WSHandler checkReceiverResults causes security problem
> ------------------------------------------------------
>
> Key: WSS-70
> URL: https://issues.apache.org/jira/browse/WSS-70
> Project: WSS4J
> Issue Type: Bug
> Reporter: Gürkan Vural
> Assignee: Fred Dushin
> Priority: Critical
> Attachments: wss4j_actions.patch
>
>
> In WSS4J 1.1.0 in WSDoAllReceiver there is a check of security actions
> which also checks the size of actions. However this part is moved in
> WSS4J 1.5 to WSHandler.java using checkReceiverResults function and
> action size check is commented out. However the checking for loop is
> controled against the size of actions received in the SOAP message. This
> cause a security problem when an empty security header is sent. It omits
> the for loop and throws no exception!
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
---------------------------------------------------------------------
To unsubscribe, e-mail: wss4j-dev-unsubscribe@ws.apache.org
For additional commands, e-mail: wss4j-dev-help@ws.apache.org