Web Web ( (SOAP (SOAP/http (WSDL UDDI 1. 2.XML 3. (XDoS http, https SOAP XML Web/App ( App

Size: px

Start display at page:

Download "Web Web ( (SOAP (SOAP/http (WSDL UDDI 1. 2.XML 3. (XDoS http, https SOAP XML Web/App ( App"

るるみたかぎ
7 years ago
Views:

1 Web XML Day XML Web Web Web

2 Web Web ( (SOAP (SOAP/http (WSDL UDDI 1. 2.XML 3. (XDoS http, https SOAP XML Web/App ( App

3 SOAP Crypto-Gram Newsletter by Bruce Schneier SOAP HTTP Web Services Security by Bilal Siddiqui SOAP Web 2 1. SOAP 2. 2 XML SOAP Web WS-* SSL SOAP XML http, https SOAP <?xml / URL IP XML 6

4 Web / DoS XML XML NAT, URL $1200 SOAP/XML XML / $1200

5 XDoS (XML Multiple Vendor XML Parser Denial Of Service Vulnerability bugtraq id 6398 object class Input Validation Error cve CVE-MAP-NOMATCH remote Yes local No published Dec 16, 2002 updated Dec 16, 2002 vulnerable Apache Software Foundation Axis 1.0 Apache Software Foundation Axis 1.1 beta Apache Software Foundation Xerces C Apache Software Foundation Xerces Perl ( Sun One WebSphere SecurityFocus XML Crimson Xerces SOAP ( XML CPU ( 9 XML [ GLSA ] PHP: Script injection through XML-RPC :00:00 URL: [ GLSA ] Ruby: Arbitrary command execution through XML-RPC :00:00 URL: SUSE Security Announcement: php/pear XML RPC remote code execution :00:00 URL: [ GLSA ] TikiWiki: Arbitrary command execution through XML-RPC :00:00 URL: Adobe Reader 7: XML External Entity (XXE Attack :00:00 URL: New Python2.2 packages fix unauthorised XML-RPC internals access :00:00 URL: IBM DB2 XML functions overflows (#NISR H :00:00 URL: IBM DB2 XML functions file creation vulnerabilities (#NISR I :00:00 URL: Microsoft IIS 5.x/6.0 WebDAV (XML parser attribute blowup DoS :00:00 URL: Multiple vendor SOAP server (XML parser denial of service (DTD parameter entities

6 -XML XML+SOAP -20 Web XML/SOAP DMZ XML app Internet SOAP Web appapp (SSL/VPN Web SSL SSL (

7 -XML RouteOne RouteOne: 4 XML DaimlerChrysler Services Ford Motor Credit / GMAC Toyota Financial Services RouteOne XML (SOAP/ SSL XML (parse XML SOAP ( 4. App XML SOA <?XML <?XML < > <01> </ > </01> <?XML < > </ > 14

8 Web Web SOA ( (

9 SOAP/XML XPath XML Parsing Validation XML XML Parsing Validation XML? SOAP/XML XML 17 : Web SAML Liberty Alliance SSO SOAP Web SOAP SOAP SAML SOAP Web SSO: LDAP SSO Web SSO 18

10 -XML (SAML SAML WS-Security ID SOAP SAML App App App App App Security App SIG (SAML 19 What s Next? <MemberList> <Member> <Name> </Name> <Address> </Address> </Member> </MemberList> <xsd:element name="name" type="xsd:string" minoccurs="1" maxoccurs="1">? <MemberList> <Member> <enc:encrypteddata Id="ED01" MimeType= " Type="http xmlns:xenc="http "> <enc:encryptionmethod Algorithm="http..."> <enc:keysize>192</enc:keysize> </enc:encryptionmethod> <ds:keyinfo xmlns:ds="http "> <ds:keyname>john</ds:keyname> </ds:keyinfo> <enc:cipherdata> <enc:ciphervalue>va2tn </enc:ciphervalue> </enc:cipherdata> </enc:encrypteddata> <Address> </Address> </Member> </MemberList> 20

11 Web End-to-end LAN DMZ WS-Security Web XML

shio_20041004.PDF

shio_20041004.PDF JPNIC JPCERT/CC 2004 Web 2004 10 4 Web Web Web WASC Web Application Security Consortium 7 Web Security Threat Classification Web URL 2 ...?? It depends!? It depends!??? 3 ? It depends!...