#4 Denial of Backup Vulnerability in poll_passives command

[Emin Martinian]

There is a vulnerability in the poll_passives command
(specifically in the ProcessGet function in the file
dibs_daemon.py) which could potentially let an
unauthorized person delete queued messages.

Imagine that Host A contacts Host B and issues a GET
request via the DIBS protocol but instead of asking B
for the messages queued for A, A pretends to be Host C
and asks B for messages queued for C. Since B does not
verify that the GET request comes from C it will send
messages queued for C to A. Host A can't do anything
useful with these messages since they are encrypted but
it interferes with the communication between B and C.

Proposed Solution: The peer issuing a GET request needs
to verify its identity somehow. One simple way to do
this is to sign the email address provided in the get
request with the peer's public key.