MBOX-Line: From mrc+imap at panda.com  Tue Mar  8 15:18:16 2011
To: imap-protocol@u.washington.edu
From: Mark Crispin <mrc+imap@panda.com>
Date: Fri Jun  8 12:34:45 2018
Subject: [Imap-protocol] Pipelined commands before completion of STARTTLS
In-Reply-To: <20334.1299625687.587275@puncture>
References: <4D7690AE.8020003@andrew.cmu.edu>
	<alpine.BSO.2.00.1103081341530.1958@morgaine.smi.sendmail.com>
	<20334.1299625687.587275@puncture>
Message-ID: <alpine.OSX.2.00.1103081512190.791@hsinghsing.panda.com>

On Tue, 8 Mar 2011, Dave Cridland wrote:
> Yes, I like (4).

But (2) is going to happen, so clients should not be surprised.

> Does the panel think there's a similar vulnerability lurking in SASL
> negotiation? I'm thinking that for SASL negotiations carried out in
> the clear, intended to negotiate a security layer, there's a similar
> injection window on the final response sent by the client - ie, the
> attacker would inject into that packet after the response, in the
> hope that buffering would "execute" the command after the client has
> completed authenticating, conceptually "within" the security layer.

How widespread are security layer implementations in SASL?

I guess that some percentage (but less than 100%) of the dozen or so sites
in the world that use Kerberos have it.  But I suspect that this train
left the station long ago, back when the STARTTLS command was added rather
than made part of SASL.

-- Mark --

http://panda.com/mrc
Democracy is two wolves and a sheep deciding what to eat for lunch.
Liberty is a well-armed sheep contesting the vote.

