CVE-2009-0612: Infoleak
Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 3.x and InterScan Web Security Suite (IWSS) 3.x, when basic authorization is enabled on the standalone proxy, forwards the Proxy-Authorization header from Windows Media Player, which allows remote web servers to obtain credentials by offering a media stream and then capturing this header.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable basic authorization on the standalone proxy. When basic authorization is enabled the proxy forwards the Proxy-Authorization header (for example from Windows Media Player), allowing remote servers to obtain credentials; disabling basic authorization prevents this header from being forwarded.
Trend Micro InterScan Web Security Suite / InterScan Web Security Virtual Appliance (standalone proxy) basic authorization = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0612?
CVE-2009-0612 has a moderate severity rating due to its potential to expose user credentials.
How do I fix CVE-2009-0612?
To fix CVE-2009-0612, disable basic authorization on the standalone proxy or upgrade to a patched version of the software.
What products are impacted by CVE-2009-0612?
CVE-2009-0612 affects Trend Micro InterScan Web Security Suite versions 2.5 and 3.1, as well as the InterScan Web Security Virtual Appliance version 3.1.
Can CVE-2009-0612 be exploited remotely?
Yes, CVE-2009-0612 can be exploited remotely by attackers who can manipulate the web server to obtain credentials.
Is there a workaround for CVE-2009-0612?
Yes, a workaround for CVE-2009-0612 involves configuring your proxy settings to prevent the forwarding of the Proxy-Authorization header.