bugtraq - Trend micro - IWSVA/IWSS - Authorization module password leak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 9 Feb 2009 06:30:09 -0700
From: david.vorel@...eynet.cz
To: bugtraq@...urityfocus.com
Subject: Trend micro - IWSVA/IWSS -  Authorization module password leak

There is possbile get username and password from "Proxy-Authorization" header, which is not correctly removed when authorization header sends WMP.

Requirements:

- IWSVA/IWSS basic authorization on
- Client is using WMP (8-11) as video player
- Standalone proxy (if upstream proxy is used, "Proxy-Authorization" header is removed by this upstream proxy)

Bug:

WMP sends authorization header in this format:

Proxy-Authorization: basic =xxxxxxxxxx

In that case IWSVA/IWSS extract correct authorization information, but it does not remove this Proxy-Authorization header. (it seems because of lovercase "b" in basic, even if IWSVA/IWSS knows, that this is authorization header and can extract correct username/password).

Scenario:

Some "bad" guy knows, that company XY use IWSVA/IWSS and basic authorization, so he sends them url with prepared video stream (whatever format for WMP) and waits for users access. When user access this url, "bad" guy gets whole "Proxy-Authorization" header which contains also base64 hash with username/password.

Happy pentesting..