Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (Security)  >   Trend Micro InterScan Web Security Vendors:   Trend Micro
InterScan Web Security Suite Discloses Proxy-Authentication Password
SecurityTracker Alert ID:  1021716
SecurityTracker URL:
CVE Reference:   CVE-2009-0612   (Links to External Site)
Updated:  Feb 19 2009
Original Entry Date:  Feb 13 2009
Impact:   Disclosure of authentication information
Exploit Included:  Yes  

Description:   A vulnerability was reported in Trend Micro InterScan Web Security Suite. A remote user can obtain password information.

When basic authorization is enabled, the system does not remove authentication information from the 'Proxy-Authentication' header in certain cases. A remote user monitoring the network or hosting a web server can obtain the username and password from the unsanitized header.

david.vorel reported this vulnerability.

Impact:   A remote user can obtain password information.
Solution:   No solution was available at the time of this entry.
Vendor URL: (Links to External Site)
Cause:   Access control error
Underlying OS:  Windows (2000), Windows (2003), Windows (2008)

Message History:   None.

 Source Message Contents

Subject:  Trend micro - IWSVA/IWSS - Authorization module password leak

There is possbile get username and password from "Proxy-Authorization" header, which is not correctly removed when authorization header
 sends WMP.


- IWSVA/IWSS basic authorization on
- Client is using WMP (8-11) as video player
- Standalone proxy (if upstream proxy is used, "Proxy-Authorization" header is removed by this upstream proxy)


WMP sends authorization header in this format:

Proxy-Authorization: basic =xxxxxxxxxx

In that case IWSVA/IWSS extract correct authorization information, but it does not remove this Proxy-Authorization header. (it seems
 because of lovercase "b" in basic, even if IWSVA/IWSS knows, that this is authorization header and can extract correct username/password).


Some "bad" guy knows, that company XY use IWSVA/IWSS and basic authorization, so he sends them url with prepared video stream (whatever
 format for WMP) and waits for users access. When user access this url, "bad" guy gets whole "Proxy-Authorization" header which contains
 also base64 hash with username/password.

Happy pentesting..


Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2022, LLC