Web 2005 12 15 XML Day XML matsu@kabuki.tel.co.jp 2005 1 1 Web Web Web 2005 2 2
Web 2005 3 3 Web ( (SOAP (SOAP/http (WSDL UDDI 1. 2.XML 3. (XDoS http, https SOAP XML Web/App ( App 2005 4 4
SOAP Crypto-Gram Newsletter by Bruce Schneier http://www.schneier.com/crypto-gram-0006.html SOAP HTTP Web Services Security by Bilal Siddiqui http://webservices.xml.com/pub/a/ws/2003/03/04/security.html SOAP Web 2 1. SOAP 2. 2 XML SOAP 2005 5 5 Web WS-* SSL SOAP XML http, https SOAP <?xml / 2005 6 URL IP XML 6
Web / 2005 7 7 DoS XML XML NAT, URL $1200 SOAP/XML XML / 2005 8 8 $1200
XDoS (XML Multiple Vendor XML Parser Denial Of Service Vulnerability bugtraq id 6398 object class Input Validation Error cve CVE-MAP-NOMATCH remote Yes local No published Dec 16, 2002 updated Dec 16, 2002 vulnerable Apache Software Foundation Axis 1.0 Apache Software Foundation Axis 1.1 beta Apache Software Foundation Xerces C++ 2.1.0 Apache Software Foundation Xerces Perl 1.7.0-1 ( Sun One WebSphere http://www.securityfocus.com/bid/6398/info/ 2005 9 SecurityFocus XML Crimson Xerces SOAP ( XML CPU ( 9 XML [ GLSA 200507-15 ] PHP: Script injection through XML-RPC 2005-07-14 18:00:00 URL: http://www.securityfocus.com/archive/1/405265 [ GLSA 200507-10 ] Ruby: Arbitrary command execution through XML-RPC 2005-07-10 18:00:00 URL: http://www.securityfocus.com/archive/1/404984 SUSE Security Announcement: php/pear XML RPC remote code execution 2005-07-07 18:00:00 URL: http://www.securityfocus.com/archive/1/404624 [ GLSA 200507-06 ] TikiWiki: Arbitrary command execution through XML-RPC 2005-07-05 18:00:00 URL: http://www.securityfocus.com/archive/1/404479 Adobe Reader 7: XML External Entity (XXE Attack 2005-06-15 18:00:00 URL: http://www.securityfocus.com/archive/1/402468 New Python2.2 packages fix unauthorised XML-RPC internals access 2005-02-03 17:00:00 URL: http://www.securityfocus.com/archive/1/389511 IBM DB2 XML functions overflows (#NISR05012005H 2005-01-04 17:00:00 URL: http://www.securityfocus.com/archive/1/386096 IBM DB2 XML functions file creation vulnerabilities (#NISR05012005I 2005-01-04 17:00:00 URL: http://www.securityfocus.com/archive/1/386097 Microsoft IIS 5.x/6.0 WebDAV (XML parser attribute blowup DoS 2004-10-11 18:00:00 URL: http://www.securityfocus.com/archive/1/378179 Multiple vendor SOAP server (XML parser denial of service (DTD parameter entities 2005 10 10
-XML XML+SOAP -20 Web XML/SOAP DMZ XML app Internet SOAP Web appapp 2005 11 11 (SSL/VPN Web SSL SSL ( 2005 12 12
-XML RouteOne RouteOne: 4 XML DaimlerChrysler Services Ford Motor Credit / GMAC Toyota Financial Services RouteOne 1. 2. XML (SOAP/ SSL XML (parse XML 5. 3. SOAP ( 4. App 2 2005 13 13 - XML 01 2004.9 SOA <?XML <?XML < > <01> 123400 123400 </ > </01> 2005 14 <?XML < > 123400 </ > 14
Web 2005 15 15 Web SOA ( ( 2005 16 16
SOAP/XML XPath XML Parsing Validation XML XML Parsing Validation XML? 2005 17 SOAP/XML 1 3 5 8 8 1 3 10 6 8 XML 17 : Web SAML Liberty Alliance SSO SOAP Web SOAP SOAP SAML SOAP Web SSO: LDAP 2005 18 SSO Web SSO 18
-XML (SAML SAML WS-Security ID SOAP SAML App App App App App Security App SIG 2005 19 (SAML 19 What s Next? <MemberList> <Member> <Name> </Name> <Address> </Address> </Member> </MemberList> <xsd:element name="name" type="xsd:string" minoccurs="1" maxoccurs="1">? 2005 20 <MemberList> <Member> <enc:encrypteddata Id="ED01" MimeType= " Type="http xmlns:xenc="http "> <enc:encryptionmethod Algorithm="http..."> <enc:keysize>192</enc:keysize> </enc:encryptionmethod> <ds:keyinfo xmlns:ds="http "> <ds:keyname>john</ds:keyname> </ds:keyinfo> <enc:cipherdata> <enc:ciphervalue>va2tn </enc:ciphervalue> </enc:cipherdata> </enc:encrypteddata> <Address> </Address> </Member> </MemberList> 20
Web End-to-end LAN DMZ WS-Security 2005 21 21 Web XML matsu@kabuki.tel.co.jp 2005 22 22