Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   


Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker

Category:   Application (Security)  >   Trend Micro InterScan Web Security Vendors:   Trend Micro
InterScan Web Security Suite Discloses Proxy-Authentication Password
SecurityTracker Alert ID:  1021716
SecurityTracker URL:
CVE Reference:   CVE-2009-0612   (Links to External Site)
Updated:  Feb 19 2009
Original Entry Date:  Feb 13 2009
Impact:   Disclosure of authentication information
Exploit Included:  Yes  

Description:   A vulnerability was reported in Trend Micro InterScan Web Security Suite. A remote user can obtain password information.

When basic authorization is enabled, the system does not remove authentication information from the 'Proxy-Authentication' header in certain cases. A remote user monitoring the network or hosting a web server can obtain the username and password from the unsanitized header.

david.vorel reported this vulnerability.

Impact:   A remote user can obtain password information.
Solution:   No solution was available at the time of this entry.
Vendor URL: (Links to External Site)
Cause:   Access control error
Underlying OS:  Windows (2000), Windows (2003), Windows (2008)

Message History:   None.

 Source Message Contents

Date:  Mon, 9 Feb 2009 06:30:09 -0700
Subject:  Trend micro - IWSVA/IWSS - Authorization module password leak

There is possbile get username and password from "Proxy-Authorization" header, which is not correctly removed when authorization header
 sends WMP.


- IWSVA/IWSS basic authorization on
- Client is using WMP (8-11) as video player
- Standalone proxy (if upstream proxy is used, "Proxy-Authorization" header is removed by this upstream proxy)


WMP sends authorization header in this format:

Proxy-Authorization: basic =xxxxxxxxxx

In that case IWSVA/IWSS extract correct authorization information, but it does not remove this Proxy-Authorization header. (it seems
 because of lovercase "b" in basic, even if IWSVA/IWSS knows, that this is authorization header and can extract correct username/password).


Some "bad" guy knows, that company XY use IWSVA/IWSS and basic authorization, so he sends them url with prepared video stream (whatever
 format for WMP) and waits for users access. When user access this url, "bad" guy gets whole "Proxy-Authorization" header which contains
 also base64 hash with username/password.

Happy pentesting..


Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

Copyright 2017, LLC