Description
Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 3.x and InterScan Web Security Suite (IWSS) 3.x, when basic authorization is enabled on the standalone proxy, forwards the Proxy-Authorization header from Windows Media Player, which allows remote web servers to obtain credentials by offering a media stream and then capturing this header.
References
- interscan-proxyauthorization-info-disc(48681) vdb-entry
- 33891 third-party-advisory
- 33687 vdb-entry
- 1021716 vdb-entry
- 20090209 Trend micro - IWSVA/IWSS - Authorization module password leak mailing-list