Trend Micro Interscan Web Security HTTP Proxy Authentication Information Disclosure Vulnerability

Bugtraq ID:	33687
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2009-0612
Remote:	Yes
Local:	No
Published:	Feb 09 2009 12:00AM
Updated:	Apr 13 2015 09:11PM
Credit:	[email protected]
Vulnerable:	Trend Micro InterScan Web Security Virtual Appliance 3.1 Trend Micro InterScan Web Security Suite for Windows 3.1 Trend Micro InterScan Web Security Suite for Windows Trend Micro InterScan Web Security Suite for Solaris Trend Micro InterScan Web Security Suite for Linux Trend Micro InterScan Web Security Suite 2.5
Not Vulnerable:

Trend Micro Interscan Web Security HTTP Proxy Authentication Information Disclosure Vulnerability

Trend Micro Interscan Web Security Suite is prone to an information-disclosure vulnerability when handling HTTP Proxy-Authentication headers.

An attacker can exploit this issue to obtain sensitive information that may lead to further attacks.

Trend Micro Interscan Web Security HTTP Proxy Authentication Information Disclosure Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

Trend Micro Interscan Web Security HTTP Proxy Authentication Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Trend Micro Interscan Web Security HTTP Proxy Authentication Information Disclosure Vulnerability

References:

• InterScan Web Security Suite Homepage (Trend Micro)
  
• InterScan Web Security Virtual Appliance Homepage (Trend Micro)
  
• Trend micro - IWSVA/IWSS - Authorization module password leak ([email protected])