Vulnerabilities > CVE-2017-6339 - Weak Password Requirements vulnerability in Trendmicro Interscan web Security Virtual Appliance
Attack vector
NETWORK Attack complexity
LOW Privileges required
LOW Confidentiality impact
HIGH Integrity impact
NONE Availability impact
NONE Summary
Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 before CP 1746 mismanages certain key and certificate data. Per IWSVA documentation, by default, IWSVA acts as a private Certificate Authority (CA) and dynamically generates digital certificates that are sent to client browsers to complete a secure passage for HTTPS connections. It also allows administrators to upload their own certificates signed by a root CA. An attacker with low privileges can download the current CA certificate and Private Key (either the default ones or ones uploaded by administrators) and use those to decrypt HTTPS traffic, thus compromising confidentiality. Also, the default Private Key on this appliance is encrypted with a very weak passphrase. If an appliance uses the default Certificate and Private Key provided by Trend Micro, an attacker can simply download these and decrypt the Private Key using the default/weak passphrase.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Brute Force In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset. Examples of secrets can include, but are not limited to, passwords, encryption keys, database lookup keys, and initial values to one-way functions. The key factor in this attack is the attackers' ability to explore the possible secret space rapidly. This, in turn, is a function of the size of the secret space and the computational power the attacker is able to bring to bear on the problem. If the attacker has modest resources and the secret space is large, the challenge facing the attacker is intractable. While the defender cannot control the resources available to an attacker, they can control the size of the secret space. Creating a large secret space involves selecting one's secret from as large a field of equally likely alternative secrets as possible and ensuring that an attacker is unable to reduce the size of this field using available clues or cryptanalysis. Doing this is more difficult than it sounds since elimination of patterns (which, in turn, would provide an attacker clues that would help them reduce the space of potential secrets) is difficult to do using deterministic machines, such as computers. Assuming a finite secret space, a brute force attack will eventually succeed. The defender must rely on making sure that the time and resources necessary to do so will exceed the value of the information. For example, a secret space that will likely take hundreds of years to explore is likely safe from raw-brute force attacks.
- Dictionary-based Password Attack An attacker tries each of the words in a dictionary as passwords to gain access to the system via some user's account. If the password chosen by the user was a word within the dictionary, this attack will be successful (in the absence of other mitigations). This is a specific instance of the password brute forcing attack pattern.
- Password Brute Forcing In this attack, the attacker tries every possible value for a password until they succeed. A brute force attack, if feasible computationally, will always be successful because it will essentially go through all possible passwords given the alphabet used (lower case letters, upper case letters, numbers, symbols, etc.) and the maximum length of the password. A system will be particularly vulnerable to this type of an attack if it does not have a proper enforcement mechanism in place to ensure that passwords selected by users are strong passwords that comply with an adequate password policy. In practice a pure brute force attack on passwords is rarely used, unless the password is suspected to be weak. Other password cracking methods exist that are far more effective (e.g. dictionary attacks, rainbow tables, etc.).
- Rainbow Table Password Cracking An attacker gets access to the database table where hashes of passwords are stored. He then uses a rainbow table of pre-computed hash chains to attempt to look up the original password. Once the original password corresponding to the hash is obtained, the attacker uses the original password to gain access to the system. A password rainbow table stores hash chains for various passwords. A password chain is computed, starting from the original password, P, via a reduce(compression) function R and a hash function H. A recurrence relation exists where Xi+1 = R(H(Xi)), X0 = P. Then the hash chain of length n for the original password P can be formed: X1, X2, X3, ... , Xn-2, Xn-1, Xn, H(Xn). P and H(Xn) are then stored together in the rainbow table. Constructing the rainbow tables takes a very long time and is computationally expensive. A separate table needs to be constructed for the various hash algorithms (e.g. SHA1, MD5, etc.). However, once a rainbow table is computed, it can be very effective in cracking the passwords that have been hashed without the use of salt.
- Try Common(default) Usernames and Passwords An attacker may try certain common (default) usernames and passwords to gain access into the system and perform unauthorized actions. An attacker may try an intelligent brute force using known vendor default credentials as well as a dictionary of common usernames and passwords. Many vendor products come preconfigured with default (and thus well-known) usernames and passwords that should be deleted prior to usage in a production environment. It is a common mistake to forget to remove these default login credentials. Another problem is that users would pick very simple (common) passwords (e.g. "secret" or "password") that make it easier for the attacker to gain access to the system compared to using a brute force attack or even a dictionary attack using a full dictionary.
Exploit-Db
| description | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities. CVE-2017-6338,CVE-2017-6339,CVE-2017-6340. Webapps exploit f... |
| id | EDB-ID:42013 |
| last seen | 2017-05-16 |
| modified | 2017-01-12 |
| published | 2017-01-12 |
| reporter | Exploit-DB |
| source | https://www.exploit-db.com/download/42013/ |
| title | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities |
Nessus
| NASL family | Firewalls |
| NASL id | TRENDMICRO_IWSVA_6_5_1746.NASL |
| description | The version of Trend Micro InterScan Web Security Virtual Appliance (IWSVA) installed on the remote host is 6.5 prior to 6.5 Build 1746. It is, therefore, affected by multiple vulnerabilities : - Multiple access control issues exist that allow an authenticated, remote attacker with low privileges to modify FTP access control, create or modify reports, or upload an HTTPS decryption certificate and private key. (CVE-2017-6338) - A flaw exists in the management of certain key and certificate data. By default, IWSVA acts as a private certificate authority (CA) and dynamically generates digital certificates that are sent to client browsers to complete a secure passage for HTTPS connections. It also allows administrators to upload their own certificates signed by a root CA. An authenticated, remote attacker with low privileges can download the current CA certificate and private key (either the default ones or ones uploaded by administrators) and use those to decrypt HTTPS traffic, resulting in a loss of confidentiality. Furthermore, the default private key on the appliance is encrypted with a very weak passphrase. The attacker can exploit this to likewise break the encryption protections. (CVE-2017-6339) - A cross-site scripting (XSS) vulnerability exists in rest/commonlog/report/template due to improper sanitization of user-supplied input to the name field. An authenticated, remote attacker with low privileges can exploit this to inject arbitrary JavaScript while creating a new report. Furthermore, due to incorrect access controls, the attacker can exploit this issue to create or modify reports, allowing arbitrary script code to be executed in a user |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 99248 |
| published | 2017-04-07 |
| reporter | This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof. |
| source | https://www.tenable.com/plugins/nessus/99248 |
| title | Trend Micro IWSVA 6.5 < 6.5 Build 1746 Multiple Vulnerabilities |
| code | |
Packetstorm
| data source | https://packetstormsecurity.com/files/download/142552/tmiwsva65sp2-xssdisclose.txt |
| id | PACKETSTORM:142552 |
| last seen | 2017-05-17 |
| published | 2017-05-17 |
| reporter | SlidingWindow |
| source | https://packetstormsecurity.com/files/142552/Trend-Micro-Interscan-Web-Security-Virtual-Appliance-IWSVA-6.5-SP2-XSS-Disclosure.html |
| title | Trend Micro Interscan Web Security Virtual Appliance (IWSVA) 6.5 SP2 XSS / Disclosure |
References
- http://www.securityfocus.com/bid/97492
- http://www.securityfocus.com/bid/97492
- https://success.trendmicro.com/solution/1116960
- https://success.trendmicro.com/solution/1116960
- https://www.qualys.com/2017/01/12/qsa-2017-01-12/qsa-2017-01-12.pdf
- https://www.qualys.com/2017/01/12/qsa-2017-01-12/qsa-2017-01-12.pdf