Trend micro - IWSVA/IWSS - Authorization module password leak

2009.02.19
Credit: david vorel
Risk: Low
Local: No
Remote: Yes
CWE: CWE-200


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

There is possbile get username and password from "Proxy-Authorization" header, which is not correctly removed when authorization header sends WMP. Requirements: - IWSVA/IWSS basic authorization on - Client is using WMP (8-11) as video player - Standalone proxy (if upstream proxy is used, "Proxy-Authorization" header is removed by this upstream proxy) Bug: WMP sends authorization header in this format: Proxy-Authorization: basic =xxxxxxxxxx In that case IWSVA/IWSS extract correct authorization information, but it does not remove this Proxy-Authorization header. (it seems because of lovercase "b" in basic, even if IWSVA/IWSS knows, that this is authorization header and can extract correct username/password). Scenario: Some "bad" guy knows, that company XY use IWSVA/IWSS and basic authorization, so he sends them url with prepared video stream (whatever format for WMP) and waits for users access. When user access this url, "bad" guy gets whole "Proxy-Authorization" header which contains also base64 hash with username/password. Happy pentesting..

References:

http://xforce.iss.net/xforce/xfdb/48681
http://www.securitytracker.com/id?1021716
http://www.securityfocus.com/bid/33687
http://www.securityfocus.com/archive/1/archive/1/500760/100/0/threaded
http://secunia.com/advisories/33891


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top