Issue 7313: Firewall FTF Issue: No ene-to-end security for firewall traversal (firewall-traversal-ftf)
Source: Syracuse University (Mr. C. Joncheng Kuo, joncheng_kuo(at)bristol.com)
Nature: Uncategorized Issue
Severity: 
Summary: The title of Section 1.7, End-to-End Secure Connection, is misleading. There is no end-to-end security in the firewall traversal spec. All security mechanisms described in this spec are essentially mechanisms between a client, firewalls, and a server, not end-to-end. Thus, it is susceptible to the man-in-the-middle attack.


I'm saying we should fix the problem, but the title of this section and the caption of Figure 1-4 is certainly misleading. Besids, if the firewall traversal scheme described in the spec is actually susceptible to the man-in-the-middle attack, we may want to consider stating it somewhere in the spec rather than making people have a wrong impression that it is secure
Resolution: 
Revised Text: 
Actions taken:
May 6, 2004: received issue
Discussion: 

End of Annotations:=====
te: Thu, 06 May 2004 17:18:53 -0400 
From: Joncheng Kuo <ckuo01@syr.edu> 
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.0; en-US; rv:1.0.2) Gecko/20021120 Netscape/7.01 
X-Accept-Language: en-us, en 
To: issues@omg.org 
CC: firewall-traversal-ftf@omg.org 
Subject: Firewall FTF Issue: No ene-to-end security for firewall traversal 


The title of Section 1.7, End-to-End Secure Connection, is misleading. There is no end-to-end security in the firewall traversal spec. All security mechanisms described in this spec are essentially mechanisms between a client, firewalls, and a server, not end-to-end. Thus, it is susceptible to the man-in-the-middle attack.


I'm saying we should fix the problem, but the title of this section and the caption of Figure 1-4 is certainly misleading. Besids, if the firewall traversal scheme described in the spec is actually susceptible to the man-in-the-middle attack, we may want to consider stating it somewhere in the spec rather than making people have a wrong impression that it is secure.


Joncheng Kuo
Syracuse University