Exploit-DB #25719
Description: Trend Micro DirectPass 1.5.0.1060 - Multiple Software Vulnerabilities
Type: dos
Platform: windows
Date: 2013-05-26
Author: Vulnerability-Lab

Exploit:
Title:
======
Trend Micro DirectPass 1.5.0.1060 - Multiple Vulnerabilities


Date:
=====
2013-05-21


References:
===========
http://www.vulnerability-lab.com/get_content.php?id=894

Article: http://www.vulnerability-lab.com/dev/?p=580

Trend Micro (Reference): http://esupport.trendmicro.com/solution/en-US/1096805.aspx
Trend Micro Solution ID: 1096805

Video: http://www.vulnerability-lab.com/get_content.php?id=951


VL-ID:
=====
894


Common Vulnerability Scoring System:
====================================
6.1


Introduction:
=============
Trend Micro™ DirectPass™ manages website passwords and login IDs in one secure location, so you only need to 
remember one password. Other features include: Keystroke encryption, secure password generation, automatic 
form-filling, confidential notes, and a secure browser.

Convenience - You can securely and easily manage passwords for numerous online accounts with just one 
password and automatically login to your websites with one click. More Security - You get an extra layer of 
online security with a specially designed browser for online banking and financial websites and protection 
from keylogging malware. No Hassles – You don’t have to be technical wizard to benefit from this password 
service, it’s simple to use. Confidence – You can have peace-of-mind using a password service provided by 
an Internet security provider with 20+ years of experience. All Your Devices – You can use DirectPass 
password manager on Windows PCs, Android mobile, Android Tablet, iPads and iPhones, and all devices are 
automatically encrypted and synchronized using the cloud

(Copy of the Vendor Homepage: http://www.trendmicro.com/us/home/products/directpass/index.html )


Abstract:
=========
The Vulnerability Laboratory Research Team discovered multiple software vulnerabilities in the official Trend Micro DirectPass v1.5.0.1060 Software.


Report-Timeline:
================
2013-03-08:	Researcher Notification & Coordination (Benjamin Kunz Mejri)
2013-03-09:	Vendor Notification (Trend Micro - Security Team)
2013-03-16:	Vendor Response/Feedback (Trend Micro - Karen M.)
2013-05-09:	Vendor Fix/Patch (Trend Micro - Active Update Server)
2013-05-15:	Vendor Fix/Patch (Trend Micro - Solution ID & Announcement)
2013-05-21:	Public Disclosure (Vulnerability Laboratory)


Status:
========
Published


Affected Products:
==================
Trend Micro
Product: DirectPass 1.5.0.1060


Exploitation-Technique:
=======================
Local


Severity:
=========
High


Details:
========
1.1
A local command injection vulnerability is detected in the official Trend Micro DirectPass v1.5.0.1060 Software.
The vulnerability allows local low privileged system user accounts to inject system specific commands or local 
path requests to compromise the software.

The vulnerability is located in the direct-pass master password setup module of the Trend Micro InstallWorkspace.exe file.
The master password module of the software allows users to review the included password in the secound step for security 
reason. The hidden protected master password will only be visible in the check module when the customer is processing to 
mouse-over onto the censored password field. When the software is processing to display the hidden password in plain the 
command/path injection will be executed out of the not parsed master password context in in the field listing.

Exploitation of the vulnerability requires a low privilege system user account with direct-pass access and low or medium 
user interaction. Successful exploitation of the vulnerability results in software and system process compromise or 
execution of local system specific commands/path.

Vulnerable File(s):
				[+] InstallWorkspace.exe

Vulnerable Module(s):
				[+] Setup Master Password

Vulnerable Parameter(s):
				[+] Master Password

Affected Module(s):
				[+] Check Listing (Master Password)


1.2
A persistent input validation vulnerability is detected in the official Trend Micro DirectPass v1.5.0.1060 Software.
The bug allows local attackers with low privileged system user account to implement/inject malicious script code on 
application side (persistent) of the software.

The persistent web vulnerability is located in the direct-pass check module when processing to list a manipulated master password. 
In step one injects a malicious iframe in the hidden fields as master password. The inserted context will be saved and the execution 
will be in the next step when processing to list the master password context in the last check module. To bypass the validation the 
and execute the injected script code the attacker needs to split (%20) the input request.

Exploitation of the vulnerability requires medium user interaction and a low privilege system user account with direct-pass.
Successful exploitation of the vulnerability can lead to persistent session hijacking (customers), persistent phishing, 
persistent external redirects to malware or scam and persistent web context manipulation of the affected vulnerable module.

Vulnerable File(s):
				[+] InstallWorkspace.exe

Vulnerable Module(s):
				[+] Setup Master Password

Vulnerable Parameter(s):
				[+] Master Password

Affected Module(s):
				[+] Check Listing (Master Password) 



1.3
A critical pointer vulnerability (DoS) is detected in the official Trend Micro DirectPass v1.5.0.1060 Software.
The bug allows local attackers with low privileged system user account to crash the software via pointer vulnerability.

The pointer vulnerability is also located in the direct-pass master password listing section. Attackers can inject scripts with 
loops  to mouse-over multiple times the hidden password check listing of the master password. The result is a stable cash down 
of the InstallWorkspace.exe. The problem occurs in the libcef.dll (1.1.0.1044)of