InterScan Web Security Suite Discloses Proxy-Authentication Password
|
|
SecurityTracker Alert ID: 1021716 |
|
SecurityTracker URL: http://securitytracker.com/id/1021716
|
|
CVE Reference:
CVE-2009-0612
(Links to External Site)
|
Updated: Feb 19 2009
|
Original Entry Date: Feb 13 2009
|
Impact:
Disclosure of authentication information
|
Exploit Included: Yes
|
|
Description:
A vulnerability was reported in Trend Micro InterScan Web Security Suite. A remote user can obtain password information.
When basic authorization is enabled, the system does not remove authentication information from the 'Proxy-Authentication' header in certain cases. A remote user monitoring the network or hosting a web server can obtain the username and password from the unsanitized header.
david.vorel reported this vulnerability.
|
Impact:
A remote user can obtain password information.
|
Solution:
No solution was available at the time of this entry.
|
Vendor URL: www.trendmicro.com/ (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
Windows (2000), Windows (2003), Windows (2008)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Mon, 9 Feb 2009 06:30:09 -0700
Subject: Trend micro - IWSVA/IWSS - Authorization module password leak
|
There is possbile get username and password from "Proxy-Authorization" header, which is not correctly removed when authorization header
sends WMP.
Requirements:
- IWSVA/IWSS basic authorization on
- Client is using WMP (8-11) as video player
- Standalone proxy (if upstream proxy is used, "Proxy-Authorization" header is removed by this upstream proxy)
Bug:
WMP sends authorization header in this format:
Proxy-Authorization: basic =xxxxxxxxxx
In that case IWSVA/IWSS extract correct authorization information, but it does not remove this Proxy-Authorization header. (it seems
because of lovercase "b" in basic, even if IWSVA/IWSS knows, that this is authorization header and can extract correct username/password).
Scenario:
Some "bad" guy knows, that company XY use IWSVA/IWSS and basic authorization, so he sends them url with prepared video stream (whatever
format for WMP) and waits for users access. When user access this url, "bad" guy gets whole "Proxy-Authorization" header which contains
also base64 hash with username/password.
Happy pentesting..
|
|
